Second-Order PHP Object Injection Vulnerability in SugarCRM Enterprise and Other Editions
CVE-2023-35810

7.2HIGH

Key Information:

Vendor: Sugarcrm
Status: Sugarcrm
Vendor: CVE Published:; 17 June 2023

What is CVE-2023-35810?

A significant vulnerabilities in SugarCRM Enterprise and other editions stem from a Second-Order PHP Object Injection flaw within the DocuSign module. This issue arises from inadequate input validation, allowing an attacker with admin user privileges to manipulate crafted requests. Consequently, malicious PHP code can be injected and executed, potentially leading to unauthorized actions within the application. Both SugarCRM Enterprise editions and 12.x releases prior to 12.0.3 are susceptible, highlighting the importance of immediate remediation and vigilance against such security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch