CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

CVE-2023-46304

Vtiger CRM version 7.5.0 is vulnerable to Remote Code Execution (RCE) due to a flaw in modules/Users/models/Module.php. An authenticated attacker can exploit an unprotected endpoint to write arbitrary PHP code into the config.inc.php file, which is executed on every page load. Technical analysis ...