CVE-2023-22952

CVE-2023-22952 is a remote code execution vulnerability in multiple SugarCRM products caused by missing input validation (CWE-20) that permits PHP code injection (CWE-94) through the EmailTemplates feature. An attacker with low-privilege (authenticated) access sends a crafted request to EmailTemplates that injects and executes arbitrary custom PHP code on the server. Successful exploitation yields full server-side code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8), and the associated public proof-of-concept demonstrates shell upload, creating risk of follow-on activity such as ransomware. Organizations running affected SugarCRM releases prior to 12.0 Hotfix 91155 are exposed. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2023-02-02, EPSS assigns an 80.1% probability of exploitation within 30 days (100th percentile), and trade press reported active attacks.

What to do: Apply the vendor fix immediately per CISA's KEV required action — SugarCRM 12.0 Hotfix 91155 or a later patched release per vendor instructions. Audit EmailTemplates and the server filesystem for injected PHP code or uploaded webshells, and review web logs for crafted requests to EmailTemplates endpoints. Treat unpatched, internet-exposed SugarCRM instances as high priority, as ransomware use is listed as unknown and active exploitation is confirmed.