What is a RCE after all? Just pieces of puzzle put together - RCE with bits and pieces (CVE-2024-36415)

Wed, 12 Feb 2025 00:00:00 +0000

Hey there,

For the part two of the series on my SuiteCRM vulnerabilities, I’ll explain how I managed, with a bit of creativity, to chain a few vulnerabilities and strange features together to achieve Remote Code Execution (RCE) on the SuiteCRM application.

Reminder: You might want to read the first part of the series, where I detail what is SuiteCRM and how I found the first vulnerability in the application. You can find it here. Everything here is done on a private lab

Using XSS filters against XSS filters - Unexpected SQL Injection (CVE-2024-36412)

Mon, 10 Feb 2025 00:00:00 +0000

Introduction

Hello there,

Since this is my first article in years, I needed something cool to write about. So, I finally decided to cover the CVEs I discovered last year in the popular tool SuiteCRM.

Back in February 2024, when I was still a full-time pentester, I was assigned a one-week pentest for a client. Looking at the scope, I came across a tool I had never seen before: SuiteCRM.

CVEs on SECarius

What is a RCE after all? Just pieces of puzzle put together - RCE with bits and pieces (CVE-2024-36415)

Using XSS filters against XSS filters - Unexpected SQL Injection (CVE-2024-36412)

Introduction