CVE-2017-14509

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue.

• CWE-20

• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14503libarchive 3.3.2 suffers from an out-of-bounds read within l…
• CVE-2017-14504ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does n…
• CVE-2017-14505DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick…
• CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demon…5.4
• CVE-2017-14507Multiple SQL injection vulnerabilities in the Content Timeli…
• CVE-2017-14508An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-1451IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
• CVE-2017-14510An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-14511An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 6…
• CVE-2017-14512NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage…
• CVE-2017-14513Directory traversal vulnerability in MetInfo 5.3.17 allows r…
• CVE-2017-14514Directory Traversal on Tenda W15E devices before 15.11.0.14 …