CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "" tags, as demonstrated by a CompanyDetailsSave action...

CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 contains a file-upload vulnerability in the logo field: an uploaded PNG image of 150x40 with an extension allowed as php3 can carry PHP code, bypassing the extension filter and enabling code execution via the image (e.g., using PHP tags). Affected files/documented ...

PT-2019-17399

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 7.1.0 before Hotfix2 Description The issue allows uploading files with the php3 extension in the logo upload field, under specific conditions, such as the file being in PNG format and having a size of 150x40. An attacker can...

CVE-2019-5009: Unrestricted Upload of File with Dangerous Type

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using " ?" tags, as demonstrated by a CompanyDetailsSave action...

Vtiger CRM 7.1.0 - Remote Code Execution

Vtiger CRM 7.1.0 - Remote Code Execution Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution Date: 2018-12-27 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.vtiger.com Software Link:...

Vtiger CRM 7.1.0 Remote Code Execution

Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution Date: 2018-12-27 Exploit Author: Azkan Mustafa AkkuA AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.vtiger.com Software Link: https://sourceforge.net/projects/vtigercrm/files/latest/download Version: v7.1.0 Category:...

Vtiger CRM 7.1.0 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.vtiger.com Software Link:...

Vtiger CRM 7.1.0 - Remote Code Execution

Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution Date: 2018-12-27 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.vtiger.com Software Link: https://sourceforge.net/projects/vtigercrm/files/latest/download Version: v7.1.0 Category:...

Vtiger CRM 6.3.0 Authenticated Logo Upload Remote Command Execution Exploit

Vtiger version 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This Metasploit module was tested against vTiger CRM versi...

Vtiger CRM 6.3.0 Authenticated Logo Upload Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vtiger CRM - Authenticated Logo Upload RCE', 'Description' = %q Vtiger 6.3.0 CRM's administration interface allows for the upload of a company...

Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload', 'Description' = %q Vtiger 6.3.0...

Vtiger CRM 6.3.0 - (Authenticated) Arbitrary File Upload (Metasploit)

Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload', 'Description' = %q...

Vtiger CRM 6.3.0 - (Authenticated) Arbitrary File Upload (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload', 'Description' = %q Vtiger 6.3.0 CRM's administration interface allows for the upload of ...

vTiger File Upload

File upload vulnerability in vTiger CompanyDetailsSave.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

The vulnerability of the CompanyDetailsSave.php file processing service in the vTiger CRM customer relationship management system allows a hacker to execute arbitrary code.

The vulnerability of the CompanyDetailsSave.php file processing service in the vTiger CRM customer relationship management system is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a direct request...

Vtiger CRM Arbitrary File Upload Vulnerability Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. An arbitrary file upload vulnerability exists in the...

CVE-2016-1713

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...

Unrestricted file upload

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...

CVE-2016-1713

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...

CVE-2016-1713

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...