SugarCRM Remote Code Execution exploit and how to fix?

[boratti]

Hi all,

I saw an exploit at http://www.ush.it/team/ush/hack-sugarcrm_520e/adv.txt for SugarCRM version (5.2.0e and earlier).
SugarCRM vendors have adviced to upgrade 5.2.0f.

How can we fix this bug without upgrade?

Best Regards.

[boratti]

I fixed the problem copying the function "safeAttachmentName" from email.php (version 5.2.0f) to earlier version (5.2.0a).

Good weeks.