CVE-2010-3909: Improper Control of Generation of Code

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...

PT-2010-5161

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.2.1 Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with a .phtml extension using the draft save feature in the Compose Mail component, and then accessing thi...