CVE-2023-35811

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-17 · updated 2026-06-17
Weakness: CWE-89

Description

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected.

Affected products

SugarCRM: from 11.0.0 before 11.0.6; from 12.0.0 before 12.0.3 — fixed in 11.0.6, 12.0.3

How to fix

Upgrade to a fixed version: SugarCRM 11.0.6, 12.0.3. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html
http://seclists.org/fulldisclosure/2023/Aug/29
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/
http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html
http://seclists.org/fulldisclosure/2023/Aug/29
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/

Get alerted when CVE-2023-35811 or the next vulnerability affects your stack