CVE-2005-3823

2005-11-2602:00:00

mitre

www.cve.org

7.6 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function.

References

marc.info/?l=full-disclosure&m=113290708121951&w=2

secunia.com/advisories/17693

securitytracker.com/id?1015274

www.securityfocus.com/archive/1/417711/30/0/threaded

www.securityfocus.com/bid/15569

www.vupen.com/english/advisories/2005/2569