Secunia

GoLd_M has reported a vulnerability in the Module Builder module for SugarCRM, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "file" parameter in modules/Builder/DownloadModule.php is not properly sanitised before being used. This can be exploited to download arbitrary files through directory traversal attacks.

Successful exploitation with arbitrary file extensions requires that "magic_quotes_gpc" is disabled.

The vulnerability is reported in version 4.5.1c. Prior versions may also be affected.

Solution
Update to version 4.5.1.d.

Provided and/or discovered by
GoLd_M

Changelog
Further details available in Customer Area

Original Advisory
Module Builder:
http://www.sugarforge.org/forum/forum.php?forum_id=2320

GoLd_M:
http://milw0rm.com/exploits/4591

Deep Links
Links available in Customer Area