CVE-2004-1227: SugarCRM Sugar Sales

High severity, CVSS 10.0. EPSS: 4.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts.

Affected products

• SugarCRM Sugar Sales: up to and including 2.0.1c

Published 2005-01-10. Last modified 2026-06-16.