Summary

CVE-2023-22952 (CVSS score: 8.8) relates to a case of missing input validation in SugarCRM that could result in the injection of arbitrary PHP code. The flaw is due to a lack of appropriate validation when uploading a malicious PNG file that contains an embedded PHP code using a vulnerable endpoint.

Description