CVE-2015-6000

2020-02-0613:55:09

certcc

www.cve.org

AI Score

Confidence

High

EPSS

0.018

Percentile

88.1%

JSON

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.

CNA Affected

[
  {
    "product": "Vtiger CRM",
    "vendor": "Vtiger",
    "versions": [
      {
        "status": "affected",
        "version": "6.3.0 and earlier"
      }
    ]
  }
]