CVE-2018-6308

Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the default_currency_name parameter to modules\Configurator\controller.php and modules\Currencies\Currency.php, the duplicate parameter to modules\Contacts\ShowDuplicates.php, the mergecur parameter to modules\Currencies\index.php and modules\Opportunities\Opportunity.php, and the load_signed_id parameter to modules\Documents\Document.php.

• CWE-89

• http://www.defensecode.com/advisories/DC-2018-01-011_SugarCRM_Community_Edition_Advisory.pdfExploit, Technical Description, Third Party Advisory
• http://www.defensecode.com/advisories/DC-2018-01-011_SugarCRM_Community_Edition_Advisory.pdfExploit, Technical Description, Third Party Advisory

Published

Jan 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6302Denial of service by blocking of new camera registration on …
• CVE-2018-6303Denial of service by uploading malformed firmware in Hanwha …
• CVE-2018-6304Stack overflow in custom XML-parser in Gemalto's Sentinel LD…
• CVE-2018-6305Denial of service in Gemalto's Sentinel LDK RTE version befo…
• CVE-2018-6306Unauthorized code execution from specific DLL and is known a…
• CVE-2018-6307LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10…
• CVE-2018-6311One can gain root access on the Foxconn femtocell FEMTO AP-F…6.8
• CVE-2018-6312A privileged account with a weak default password on the Fox…7.2
• CVE-2018-6313Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote a…
• CVE-2018-6315The outputSWF_TEXT_RECORD function (util/outputscript.c) in …
• CVE-2018-6316Ivanti Endpoint Security (formerly HEAT Endpoint Management …
• CVE-2018-6317The remote management interface in Claymore Dual Miner 10.5 …