A Stored Cross-Site Scripting (XSS) vulnerability was found within SugarCRM. The vulnerability is exploited through the online Documents section of the application. By crafting a name that includes XSS code it is possible to inject malicious data, redirect the user to a bogus replica of the real website, or other nefarious activity.
Within the SugarCRM User Interface (UI) go to the Documents List. Click on the one just created. This will execute the script. You will see the script right in the document list- very obvious to most users that something doesn't look right. The next example is slighly more covert.
Example #2
Within the SugarCRM UI go to the Document List. Hover over the Document Name you just created, right-click, and then copy the URL location. You will see the URL does not have any of the scripting, it has been replaced with queries directly to a Record variable within the application. This would probably be the tact a Phisher would take.
Patch Availability:
A patch has been made available via the vendor. It is recommended a routine to sanitize user input be consistently implemented throughout the application to mitigate other such occurrences within the application.
