The SugarCRM administration panel has a button labeled "remove XSS". We have a picture of it up in our office.<p>Yes. A button that attempts to remove XSS payloads from the database that admins can click. That's the level of security competence we are talking about here.<p>Edit: Here is the button: <a href="http://i.imgur.com/hC9KmWh.png" rel="nofollow">http://i.imgur.com/hC9KmWh.png</a>
> there are still chances for both authenticated (CVE-2012-0694) and unauthenticated (KIS-2016-07) attackers to exploit PHP internal memory corruption vulnerabilities which do not require objects declarations, like this ten years old vulnerability which requires just an array definition or this one which relies on references and arrays declarations<p>The two bugs linked were both fixed around 10 years ago. If you're running PHP v4.4, your problems are basically infinite. It would be nice to make a clearer distinction between PHP problems and SugarCRM problems.
How timely; I recently evaluated sugarcrm/suitecrm but similar to author was dismayed by their code quality.<p>Does anyone have any recommendations of other open source CRMs?
Whoa! That's horrifying. Not only don't they update their open source version when fixing security bugs (Great argument against choosing open core solutions btw), they don't even fix most bugs!
A few years ago, my team and I tried building a small CRM solution based on SugarCRM; we figured, "hey, it's basically a simple CRUD app with some reports and somewhat-dynamic objects, right"?<p>We gave up after a week (ended up building the thing in Django). vTiger/SugarCRM is most likely the worst PHP codebase still in active development/production.
The core issue is that sugar crm uses PHP built in `unserialize` on user controlled input, and they don't want to switch to json ostensibly because of performance issues.<p>Why don't they hmac the payloads (with a timestamp and something tied to the user (an ID, the username, whatever)) and verify the hmac before deserializing?Verifying an hmac prevents undetected tampering, is fast, and there are libraries for it in ~every language.
I wonder what's the use case for serializing and unserializing objects using php built-in functions. Is this some kind of "I'm too lazy to json encode a subset of properties" or are there some edge cases where one would use this extremely sharp knife?
Other CRM providers would probably deserve a closer look too.<p>Marketcircle for example has never been able to offer reliable SSL support for its CalDAV / CardDAV server. And they are switching to a cloud solution too – closed source and proprietary …
response to the blog: <a href="https://blog.sugarcrm.com/2017/04/24/important-security-update/" rel="nofollow">https://blog.sugarcrm.com/2017/04/24/important-security-upda...</a>
Can someone recommend a CRM? Preferably open source and free?<p>Currently we are considering odoo but any advice appreciated.
<a href="https://comparisons.financesonline.com/sugar-crm-vs-odoo" rel="nofollow">https://comparisons.financesonline.com/sugar-crm-vs-odoo</a>