CVE-2004-1227

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

4.15% chance of exploitation in the next 30 days, 90th percentile

Published

2004-12-15

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24769

References

• CVE Record
• NVD entry

Related

• CVE-2004-1225
• CVE-2004-1235
• CVE-2004-1223
• CVE-2004-1254
• CVE-2004-1221
• CVE-2004-1256