Daniel Fabian has reported some vulnerabilities in Sugar Sales, which can be exploited by malicious people to disclose sensitive information.

1) Input passed to certain parameters is not properly sanitised before being used to include files. This can be exploited via directory traversal attacks to disclose the contents of arbitrary local files.

Examples:
http://[host]/sugarcrm/modules/Users/Login.php?theme=[file]%00
http://[host]/sugarcrm/modules/Calls/index.php?theme=[file]%00

Successful exploitation requires that "register_globals" is enabled.

2) Some installation script files are not correctly removed after installation, which may be exploited to disclose the database password.

It is also possible to disclose the full path to "phprint.php" by accessing it with invalid parameters.

The vulnerabilities have been reported in versions 2.0.1a, 2.0.1b, and 2.0.1c. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.
Further details available to Secunia VIM customers

Provided and/or discovered by
Daniel Fabian

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers