CVE-2023-22952
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the...
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
- Record
CVE-2023-22952- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
CVE List
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
- Record
CVE-2023-22952- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-27053
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
- Record
EUVD-2023-27053- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g9w6-c3gx-pmr3
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the...
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
- Record
GHSA-g9w6-c3gx-pmr3- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Multiple SugarCRM Products Remote Code Execution Vulnerability
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
- Record
CVE-2023-22952- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | SugarCRM unauthenticated Remote Code Execution (RCE) | 2022-12-28 |
| Nuclei | SugarCRM Unauthenticated - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22952 is a high vulnerability (CVSS 8.8) in Sugarcrm, published January 11, 2023. CISA lists it as known to be exploited, since February 2, 2023. EUVD reports exploitation since February 2, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 80.1%, the 99th percentile. No source names a fixed version.
References
support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001
packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952
nvd.nist.gov/vuln/detail/CVE-2023-22952
github.com/advisories/GHSA-g9w6-c3gx-pmr3