SugarCRM ≤ 14.0.0 (css/preview) LESS Code Injection Vulnerab...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://karmainsecurity.com/KIS-2025-04
• Blog Title: SugarCRM ≤ 14.0.0 (css/preview) LESS Code Injection Vulnerability
• Suggested Section: web/less-code-injection-ssrf

🎯 Content Summary

SugarCRM ≤ 14.0.0 (css/preview) LESS Code Injection Vulnerability

Software Link: https://www.sugarcrm.com

Affected Versions

All commercial SugarCRM releases prior to 13.0.4 and 14.0.1.

Vulnerability Description

The /rest/v10/css/preview endpoint accepts user-supplied GET parameters (e.g. ?baseUrl=…&lm=…) and embeds them directly...

🔧 Technical Details

LESS code injection via unsanitized GET parameter: By embedding attacker-controlled input directly into the LESS source, one can terminate the current statement (e.g., using a semicolon) and append new LESS directives, enabling arbitrary code execution at the stylesheet preprocessing stage.

Abusing the LESS @import (inline) directive: This feature fetches and inlines external resources—local files (via file://) or remote URLs—into the compiled CSS. An attacker ...

🤖 Agent Actions

Added detailed coverage for LESS code injection leading to SSRF & local file read:

1. Created new page
   • src/pentesting-web/less-code-injection-ssrf.md
   – Explains LESS injection, exploitation with @import (inline), PoC, detection, mitigations, and real‐world SugarCRM case.
   – Includes references and HackTricks training banners.

2. Linked the new page from a related section
   • Updated src/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.md
   – Added SugarCRM bullet with reference link to the new LESS injection page.

These updates integrate the new technique into existing SSRF documentation for easier discovery.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 850
• MD files fixed: 4

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://karmainsecurity.com/KIS-2025-04

Content Categories: Based on the analysis, this content was categorized under "web/less-code-injection-ssrf".

Repository Maintenance:

• MD Files Formatting: 850 files processed (4 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0