{"cveID":"CVE-2023-22952","vendorProject":"SugarCRM","product":"Multiple Products","vulnerabilityName":"Multiple SugarCRM Products Remote Code Execution Vulnerability","dateAdded":"2023-02-02","shortDescription":"Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-02-23","knownRansomwareCampaignUse":"Unknown","notes":"https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/;  https://nvd.nist.gov/vuln/detail/CVE-2023-22952","cwes":["CWE-20"],"year":2023,"state":"stale","stale_reasons":["T1562.001 was revoked (superseded by T1685)"],"mappings":[{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1190","technique_name_at_mapping":"Exploit Public-Facing Application","mapping_type":"exploitation_technique","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1021.001","technique_name_at_mapping":"Remote Desktop Protocol","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1059","technique_name_at_mapping":"Command and Scripting Interpreter","mapping_type":"primary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1070.004","technique_name_at_mapping":"File Deletion","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1078","technique_name_at_mapping":"Valid Accounts","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1083","technique_name_at_mapping":"File and Directory Discovery","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1482","technique_name_at_mapping":"Domain Trust Discovery","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1505.003","technique_name_at_mapping":"Web Shell","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1530","technique_name_at_mapping":"Data from Cloud Storage","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2023-22952","technique":"T1562.001","technique_name_at_mapping":"Disable or Modify Tools","mapping_type":"secondary_impact","capability_group":"code_execution","comments":"This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user.","references":["https://censys.com/tracking-a-sugarcrm-zero-day/","https://attackerkb.com/topics/E486ui94II/cve-2023-22952","https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1021.001","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Remote Desktop Protocol","name_at_mapping":"Remote Desktop Protocol","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":16,"has_detection_strategy":true},{"id":"T1059","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Command and Scripting Interpreter","name_at_mapping":"Command and Scripting Interpreter","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":95,"has_detection_strategy":true},{"id":"T1070.004","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"File Deletion","name_at_mapping":"File Deletion","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":15,"has_detection_strategy":true},{"id":"T1078","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Valid Accounts","name_at_mapping":"Valid Accounts","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":56,"has_detection_strategy":true},{"id":"T1083","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"File and Directory Discovery","name_at_mapping":"File and Directory Discovery","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":24,"has_detection_strategy":true},{"id":"T1190","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Exploit Public-Facing Application","name_at_mapping":"Exploit Public-Facing Application","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":149,"has_detection_strategy":true},{"id":"T1482","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Domain Trust Discovery","name_at_mapping":"Domain Trust Discovery","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":17,"has_detection_strategy":true},{"id":"T1505.003","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Web Shell","name_at_mapping":"Web Shell","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":35,"has_detection_strategy":true},{"id":"T1530","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Data from Cloud Storage","name_at_mapping":"Data from Cloud Storage","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":0,"has_detection_strategy":true},{"id":"T1562.001","domains":["enterprise"],"in_current_bundle":true,"live":false,"name_now":"Disable or Modify Tools","name_at_mapping":"Disable or Modify Tools","renamed":false,"revoked_by":"T1685","mapping_types":["secondary_impact"],"sigma_rule_count":0,"has_detection_strategy":false}],"mapping_types":["exploitation_technique","primary_impact","secondary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"partial","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-24 19:45 UTC","_attack_version":"19.2"}