Critical · 9.1 CVE-2024-36415 EUVD-2024-36072

SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution

Published Jun 10, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

Affected products

Vendor	Product	Affected	Fixed
salesagility	SuiteCRM	< 7.14.4, >= 8.0.0, < 8.6.1	—

References

https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-c82f-58jv-jfrh