CVE-2023-22952

What it actually does

This vulnerability is an authenticated remote code execution flaw in SugarCRM caused by missing input validation in the EmailTemplates functionality. A user with CRM access can submit a crafted request that injects PHP code into an email template-related execution path. If the payload is stored or processed by the application in a PHP-executable context, the injected code can run with the privileges of the SugarCRM web application process. Successful exploitation can allow command execution, web shell deployment, credential theft, data access, persistence, and full compromise of the SugarCRM application server.

Why it matters to the business

An attacker who obtains or already has a valid SugarCRM account can potentially take control of the CRM application server and access sensitive customer, sales, contact, and business workflow data. Because this vulnerability is listed in CISA KEV, has high EPSS probability, and is documented as exploited in the wild, unpatched internet-accessible SugarCRM deployments should be treated as high-priority risk even though exploitation requires authentication. The CISA remediation deadline was 2023-02-23, so any remaining exposure is significantly overdue.

How an attack unfolds

An attacker first gains access to a valid SugarCRM account, often through stolen credentials, phishing, credential stuffing, password reuse, or compromise of a low-privileged CRM user. The attacker then sends a crafted request to the EmailTemplates functionality containing PHP code where the application expects template content or related input. Because vulnerable versions do not properly validate or neutralize this input, the PHP payload may be stored or later processed by the application. When SugarCRM handles the malicious template, the injected PHP executes under the web server account. From there, the attacker can run operating system commands, place a web shell, read application configuration files, access CRM data, harvest database credentials, pivot to connected systems, and establish persistence.

How to fix it

Upgrade SugarCRM to a non-vulnerable release or apply the vendor fix. The described affected range is SugarCRM before 12.0 with Hotfix 91155; organizations should apply Hotfix 91155 or upgrade to SugarCRM 12.0 or later, following vendor guidance for the deployed edition and support branch. If immediate patching is not possible, restrict access to SugarCRM to trusted networks or VPN, disable or tightly limit access to EmailTemplates administration, enforce least privilege for CRM users, require MFA, rotate credentials for potentially exposed accounts, and use WAF or reverse-proxy controls to block requests containing PHP code markers in EmailTemplates-related parameters. Mitigations should be considered temporary because this is actively exploited in the wild.

How to confirm the fix worked

Confirm the deployed SugarCRM version and hotfix level from the application administration interface, package metadata, or vendor-supported version check process. Verify that Hotfix 91155 or a later fixed release is installed on every application node. Review the EmailTemplates feature with a non-malicious validation string to confirm that server-side validation rejects PHP tags and dangerous code constructs rather than storing or executing them. Search the application filesystem and template content for unexpected PHP code, newly modified template artifacts, or web-accessible files created around suspicious access times. Confirm that web server and application logs no longer show successful EmailTemplates requests containing code-like payloads after remediation.

Typical attack path

1. Acquire valid SugarCRM credentials or compromise an existing authenticated user session.
2. Access the EmailTemplates feature or send a crafted HTTP request targeting EmailTemplates-related actions.
3. Submit template content or parameters containing PHP code or code-execution primitives.
4. Trigger the application path that stores, renders, compiles, or otherwise processes the malicious template.
5. Execute attacker-controlled PHP in the context of the SugarCRM web application.
6. Use code execution to deploy a web shell, run commands, read configuration files, and access CRM data.
7. Escalate access by stealing credentials, API keys, database connection details, or session material.
8. Maintain persistence and cover tracks by modifying templates, custom files, scheduled jobs, or other application artifacts.

How to detect it

Investigate web server access logs, reverse proxy logs, WAF events, SugarCRM application logs, authentication logs, file integrity monitoring data, endpoint telemetry, and outbound network logs. Focus on authenticated requests to EmailTemplates functionality that contain PHP tags, encoded payloads, command-execution functions, or unusually long template fields. Review successful logins shortly before suspicious EmailTemplates activity, especially from unfamiliar IP addresses, impossible travel, new user agents, or accounts that normally do not manage templates. Inspect stored email templates and related application artifacts for embedded PHP code, obfuscation, base64 decoding, command execution, file upload logic, or web shell behavior. Examine the SugarCRM web root, cache, custom extension areas, upload directories, and recently modified PHP files for unexpected code. On the host, look for web server child processes spawning shells, interpreters, network utilities, or archive tools. Because exploitation can lead to credential theft, also review database access patterns, configuration file reads, unusual API activity, and outbound connections to unfamiliar infrastructure.

• module=EmailTemplates
• index.php?module=EmailTemplates
• action=EmailTemplates
• action=Save&module=EmailTemplates
• %3C%3Fphp
• <?php
• <?=
• base64_decode(
• eval(
• assert(
• shell_exec(
• system(
• passthru(
• exec(
• popen(
• proc_open(
• file_put_contents(
• move_uploaded_file(
• /cache/modules/EmailTemplates/
• /custom/modules/EmailTemplates/
• /modules/EmailTemplates/
• /upload/
• cmd=
• whoami
• /bin/sh
• /bin/bash
• powershell.exe
• certutil.exe

What your security team should do

• Treat unpatched SugarCRM instances as urgent due to KEV status, high EPSS, and confirmed exploitation in the wild.
• Patch or upgrade immediately to SugarCRM 12.0 or later, or apply Hotfix 91155 where applicable.
• Inventory all SugarCRM deployments, including test, staging, disaster recovery, and externally exposed instances.
• Review all accounts with access to EmailTemplates and remove unnecessary privileges.
• Enable MFA for SugarCRM users and reset passwords for accounts with suspicious activity or broad privileges.
• Hunt for prior exploitation in web server logs, application logs, template content, and application directories before assuming patching fully resolves risk.
• Look for PHP code, web shells, unexpected custom files, modified templates, and outbound connections from the CRM server.
• Rotate application secrets, database credentials, API tokens, and integration credentials if compromise is suspected.
• Restrict administrative and template-management functions to trusted networks and monitored administrator accounts.
• Add SIEM and WAF detections for EmailTemplates requests containing PHP tags or suspicious PHP execution functions.