CVE-2004-1227

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts.

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

4.15% chance of exploitation in the next 30 days, 91st percentile

Published

2004-12-15

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24769

Security advisories

• http://www.securityfocus.com/bid/11740

References

• CVE Record
• NVD entry