CVE-2017-5218

Name: CVE-2017-5218
Creator: NVD / NIST
Published: 2017-02-02T07:59:00.13+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.48%

Last modified Jun 17, 2026

CVE-2017-5218 is a vulnerability of currently unknown severity. A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. EPSS estimates a 1.48% chance of exploitation in the next 30 days.

Description

A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user's session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'-- URI is a Proof of Concept.

Metrics

EPSS Probability

1.48%

70.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-89

Affected Software

Vendor	Product	Versions
Sagecrm	Sagecrm	7.0
Sagecrm	Sagecrm	7.1
Sagecrm	Sagecrm	7.2
Sagecrm	Sagecrm	7.3

References

http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/Third Party Advisory
http://www.securityfocus.com/bid/95968Third Party Advisory, VDB Entry
http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/Third Party Advisory
http://www.securityfocus.com/bid/95968Third Party Advisory, VDB Entry

Timeline

Published: Feb 2, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-5218?

How severe is CVE-2017-5218?

Severity scoring for CVE-2017-5218 is pending analysis. The EPSS model estimates a 1.48% probability of exploitation in the next 30 days.

How do I fix CVE-2017-5218?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-5218?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST