EIP-0077b802
A type confusion vulnerability exists within SalesAgility SuiteCRM within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.
Vulnerability Identifiers
- Exodus Intelligence: EIP-0077b802
- MITRE CVE: Pending
Vulnerability Metrics
- CVSSv2 Score: 9.7
Vendor References
Discovery Credit
- Exodus Intelligence
Disclosure Timeline
- Disclosed to affected vendor: March 2nd, 2022
- Disclosed to public: June 9th, 2022
Further Information
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.