CVE-2023-22952

Timeline

Detection, updates, and resolution for this record.

1. Jan 11, 2023 · Catalog

   Detected

   Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

2. Feb 2, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Feb 23, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

Affected

• cpe sugarcrm/sugarcrmversion unspecified
• vendor SugarCRM Multiple Productsversion unspecified

Sources

• CISA KEVCVE-2023-22952

  Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

  cisa.gov
• CVE.orgCVE-2023-22952

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-22952

  30-day exploitation probability 80.1%

  first.org
• Metasploit Modulesexploit_multi/http/sugarcrm_webshell_cve_2023_22952

  Public module reference (good). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2023-22952

  In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• CISA note · support.sugarcrm.com
• US Government Resource · cisa.gov