Sugar Suite Open Source (SugarCRM) 4.2 and earlier when register_globals is enabled does not protect critical variables such as $_GLOBALS and $_SESSION from modification which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion as demonstrated by modifying the GLOBALSsugarEntry parameter.