CVE-2017-14508

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.

• CWE-89

• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14502read_header in archive_read_support_format_rar.c in libarchi…
• CVE-2017-14503libarchive 3.3.2 suffers from an out-of-bounds read within l…
• CVE-2017-14504ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does n…
• CVE-2017-14505DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick…
• CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demon…5.4
• CVE-2017-14507Multiple SQL injection vulnerabilities in the Content Timeli…
• CVE-2017-14509An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-1451IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
• CVE-2017-14510An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-14511An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 6…
• CVE-2017-14512NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage…
• CVE-2017-14513Directory traversal vulnerability in MetInfo 5.3.17 allows r…