Design/Logic Flaw

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "" tags, as demonstrated by a CompanyDetailsSave action...

CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "" tags, as demonstrated by a CompanyDetailsSave action...

PT-2017-2023

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 6.4.0 Description The issue is related to an unrestricted file upload vulnerability in the Settings Vtiger CompanyDetailsSave Action class. This allows remote authenticated users to execute arbitrary code by uploading a...