3 ms·
The good thing is that Sugar is slowly but steadily replacing the old codebase but they should be more transparent on addressing these serious issues.
by dmilicevic 9y ago
The good thing is that Sugar is slowly but steadily replacing the old codebase but they should be more transparent on addressing these serious issues.
- mgmarum 9y agoYes. For example, SugarCRM is adding prepared statement support which mitigates any potential SQL injection problems. I mention this since it was posted just this last week. These changes are very large and far reaching so it does take time. https://developer.sugarcrm.com/2017/04/17/use-of-prepared-statements-in-sugar-7-9/ https://developer.sugarcrm.com/2017/04/17/use-of-prepared-st...
- dmilicevic 9y agoGreat stuff again Matthew :), your blogs are always easy to read and helpful! Personally I think that string concatenation in query building throughout the Sugar code base (campaigns, workflows) is very problematic and could also be exposed in a couple of scenarios. But like I said, this seems to be the work in progress currently at Sugar. Hopefully Sugar will come forward with a response to these allegations because these are serious security risks.
- mgmarum 9y agoThanks. Yes, I am hopeful that a response will be forthcoming.
- bpicolo 9y ago> mitigates any potential SQL injection problems Not quite, string concat for defining queries is still plenty vulnerable regardless of PDO.
- dmilicevic 9y agoit mitigates quite some SQL injection possibilities, but yes, string concat while building queries still remains an issue.
- tedivm 9y agoPrepared statements were considered the best practice for over a decade now. I know these things take time but the fact that this is just happening now is actually more cause for alarm, not less.