CVE-2023-35808: 
SugarCRM vulnerability analysis and mitigation

An Unrestricted File Upload vulnerability (CVE-2023-35808) was discovered in SugarCRM Enterprise before versions 11.0.6 and 12.x before 12.0.3, affecting the Notes module. The vulnerability was discovered on February 14, 2023, and fixed versions were released on April 12, 2023. The issue affects all editions of SugarCRM, not just Enterprise (NVD, Full Disclosure).

The vulnerability exists in the Notes module's 'save' action, which allows uploading any type of file to the /upload/ directory. While the main SugarCRM .htaccess file typically protects against PHP file execution, this protection can be bypassed if a subdirectory contains another .htaccess file. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with low attack complexity (NVD, Full Disclosure).

An attacker with regular user privileges can exploit this vulnerability to upload and execute arbitrary PHP code on the server by first uploading a custom .htaccess file followed by malicious PHP files. This could lead to complete system compromise, allowing unauthorized access to sensitive data and potential system manipulation (NVD).

The vulnerability requires regular user privileges to exploit and can be triggered through crafted requests to the Notes module. A proof of concept exploit has been publicly released, increasing the likelihood of exploitation in the wild (Full Disclosure).

Users are advised to upgrade to SugarCRM version 12.3.0, 12.0.3, 11.0.6, or later versions to address this vulnerability. These versions include proper input validation to prevent unrestricted file uploads (Full Disclosure).