mcorybillington/SuiteCRM-RCE

mcorybillington/SuiteCRM-RCE

GitHubGitHub
GitHubgithub.com
Releases0
Stars2
Writeup on CVE-2020-28328: SuiteCRM Log File Remote Code Execution plus some bonus Cross-Site Scripting
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2020-28328↗
8.8 HIGH9 HIGH

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.