Sql injection

Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...

PT-2014-2662

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 5.0.0 through 5.4.0 Description The issue allows remote attackers to execute arbitrary SQL commands via several parameters, including the picklist name parameter in the "get picklists" method to "soap/customerportal.php", t...