Vulnerability Database

296,336

Total vulnerabilities in the database

CVE-2011-4833

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.

  • Published: Dec 15, 2011
  • Updated: Apr 13, 2023
  • CVE: CVE-2011-4833
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
sugarcrm / sugarcrm 6.2.3 6.2.3.x
sugarcrm / sugarcrm 6.2.2 6.2.2.x
sugarcrm / sugarcrm 6.1.3 6.1.3.x
sugarcrm / sugarcrm 6.1.4 6.1.4.x
sugarcrm / sugarcrm 6.1.0 6.1.0.x
sugarcrm / sugarcrm 6.1.1 6.1.1.x
sugarcrm / sugarcrm 6.3.0-rc2 6.3.0-rc2.x
sugarcrm / sugarcrm 6.1.2 6.1.2.x
sugarcrm / sugarcrm 6.2.0 6.2.0.x
sugarcrm / sugarcrm 6.1.6 6.1.6.x
sugarcrm / sugarcrm 6.3.0-rc1 6.3.0-rc1.x
sugarcrm / sugarcrm 6.1.5 6.1.5.x
sugarcrm / sugarcrm 6.4 6.4.x
sugarcrm / sugarcrm 6.2.1 6.2.1.x