SugarCRM Multiple Cross-Site Scripting Vulnerabilities
Purplemet Lab team discovered multiple cross-site scripting (XSS) vulnerabilities in SugarCRM 6.5.x (CVE-2018-17784). These versions embed the following third party components: FlashCanvas which provides flashcanvas.swf and YUI which provides uploader.swf and io.swf. These Flash files are vulnerable to a cross-site scripting.
SugarCRM Community Edition 6.5 reached its end-of-life and is no longer supported. SurgarCRM 6.5.26 is the last version and no patches will be provided by the vendor.
Proof of concept
The vulnerabilities can be triggered using the following URL:
Purplemet technology detection
Purplemet detects SurgarCRM with version, YUI and flags FlashCanvas as Unsafe component.