CVE-2010-3909

Vtiger CRM (5.2.0 and potentially earlier) contains an incomplete blacklist vulnerability in config.template.php that, via the draft save feature in Compose Mail, allows a remote authenticated user to upload a .phtml file and then access it from storage/ to execute code. The issue enables Remote ...

CVE-2010-3909: Improper Control of Generation of Code

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...