CVE-2012-0694: SugarCRM CE PHP object injection via unserialize() allows RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code available, and high EPSS probability on an end-of-life product.

What it is

SugarCRM Community Edition 6.3.1 and earlier passes user-controlled input to PHP's unserialize() in its scripts. This lets a remote attacker inject crafted serialized data and execute arbitrary PHP code on the server. The flaw is rated critical and affects an end-of-life CRM product, so unpatched instances remain exposed.

Impact

An unauthenticated remote attacker can run arbitrary PHP code on the SugarCRM server, leading to full compromise of the application and its data, and potentially the underlying host.

Attack surface

Reachable over the network through the affected SugarCRM scripts that call unserialize() on user input; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

An Exploit-DB entry exists, indicating public exploit code, and EPSS is high at roughly 0.67 (99th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade SugarCRM CE to a supported release above 6.3.1, or migrate off the end-of-life product.
• If upgrade is not possible, remove or disable the scripts that pass user input to unserialize().
• Restrict network access to the SugarCRM instance with a firewall or reverse proxy allowlist.
• Run the application under a low-privilege account and apply PHP hardening to limit code execution impact.

Detection

• Search web and PHP logs for requests containing serialized object payloads (for example O: or a: patterns) to SugarCRM endpoints.
• Monitor for unexpected PHP file creation or outbound connections from the SugarCRM host.
• Alert on POST requests to SugarCRM scripts from untrusted source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.