CVE-2023-46816: 
SugarCRM vulnerability analysis and mitigation

A Server Site Template Injection (SSTI) vulnerability (CVE-2023-46816) was discovered in SugarCRM versions 12 before 12.0.4 and 13 before 13.0.2. The vulnerability was identified in the GecControl action and was disclosed on October 27, 2023. The affected systems include SugarCRM Enterprise, Sell, and Serve editions (NVD, SugarCRM Advisory).

The vulnerability allows custom PHP code injection via the GetControl action due to missing input validation. The severity is rated as HIGH with a CVSS v3.1 Base Score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) (NVD).

If exploited, this vulnerability could allow an attacker with regular user privileges to inject and execute custom PHP code through the GetControl action, potentially leading to unauthorized access, data manipulation, or system compromise (SugarCRM Advisory).

The vulnerability can be exploited by an attacker with regular user privileges using a crafted request through the GetControl action. As of the advisory publication, there were no reported incidents related to this vulnerability (SugarCRM Advisory).

SugarCRM has released patches to address this vulnerability in versions 12.0.4 and 13.0.2. On-site customers are strongly recommended to upgrade to the fixed release versions. SugarCloud customers will receive the upgrade automatically. No workarounds are available for this vulnerability (SugarCRM Advisory).