CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "" tags, as demonstrated by a CompanyDetailsSave action...

Vtiger CRM Arbitrary File Upload Vulnerability Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. An arbitrary file upload vulnerability exists in the...

vtiger Company Logo Upload Arbitrary Command Execution Vulnerability

vtiger CRM is a Web-based sales force automation SFA based customer relationship management system CRM. A security vulnerability exists in the logo upload function in the vtiger CRM SettingsVtigerCompanyDetailsSaveAction class, which allows authenticated users to upload arbitrary files and execut...