CVE-2004-1227

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-01-10 · updated 2026-06-16

Description

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts.

Affected products

SugarCRM Sugar Sales: through 2.0.1c

References

http://marc.info/?l=bugtraq&m=110295433323795&w=2
http://www.gulftech.org/?node=research&article_id=00053-120104
http://www.securityfocus.com/bid/11740
https://exchange.xforce.ibmcloud.com/vulnerabilities/18326
http://marc.info/?l=bugtraq&m=110295433323795&w=2
http://www.gulftech.org/?node=research&article_id=00053-120104
http://www.securityfocus.com/bid/11740
https://exchange.xforce.ibmcloud.com/vulnerabilities/18326

Get alerted when CVE-2004-1227 or the next vulnerability affects your stack