Description
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
SugarCRM unserialize() PHP Code Execution
exploit/unix/webapp/sugarcrm_unserialize_exec
Exploit-DB 2
- SugarCRM CE 6.3.1 - 'Unserialize()' PHP Code Execution (Metasploit) EDB-19403 · webapps · Jun 26, 2012 · verified
- SugarCRM CE 6.3.1 - 'Unserialize()' PHP Code Execution EDB-19381 · webapps · Jun 23, 2012
GitHub 1 repository
-
marinovharisan/CVE-2012-0694-SugarCRM-PoC ★ 0 · Nov 9, 2026
Python 3 proof-of-concept generator for CVE-2012-0694, a PHP deserialization vulnerability affecting SugarCRM CE ≤ 6.3.1. Supports custom command payloads, Base64 encoding, and execution verification.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.