CVE-2014-2268

views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the dbname...

Vtiger CRM <= 6.0.0 Arbitrary File Disclosure Vulnerability

Vtiger CRM is prone to an arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-1222

Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...

Directory traversal

Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...

CVE-2014-1222

CVE-2014-1222 affects Vtiger CRM prior to 6.0.0 Security Patch 1, where a vulnerability in the kcfinder/browse.php component allows remote authenticated users to read arbitrary files via directory traversal (.. in the file parameter) in a download action. The issue is likely in KCFinder and may a...

CVE-2014-1222

Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...

vTiger - CRM Lead Capture Unspecified

The WordPress Vtiger WordPress plugin was affected by a CRM Lead Capture Unspecified security vulnerability...

vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities

No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion...

Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA (browse.php, file param) - Local File Inclusion

... Vtiger CRM是美国Vtiger公司的一套基于SugarCRM开发的客户关系管理系统（CRM）。该管理系统提供管理、收集、分析客户信息等功能。 ... Vtiger CRM 6.0.0 Security patch 1之前版本的kcfinder/browse.php脚本中存在目录遍历漏洞。远程攻击者可通过download操作中的‘file’参数中的目录遍历字符‘..’利用该漏洞读取任意文件。 POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1 Host:...

Vtiger CRM 5.4.0 (index.php, onlyforuser param) - SQL Injection

No description provided by source...

vtiger CRM 4.2 RSS Aggregation Module Feed XSS

No description provided by source. source: http://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is prone to multiple SQL injection, HT...

vtiger CRM 5.0.4 Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/30951/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the...

vTiger CRM SOAP AddEmailAttachment - Arbitrary File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include REXML include...

vtiger CRM 5.1.0 - Local File Inclusion

No description provided by source. Exploit Title: VTiger CRM Google Dork: None Date: 20/03/2012 Author: Pi3rrot Software Link: http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.1.0/ Version: 5.1.0 Tested on: CentOS 6 CVE : none We have find this vulnerabilitie in VTiger 5.1.0 In th...

vtiger CRM 4.2 Leads Module record Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is prone to multiple SQL injection, HT...

vtiger CRM 4.2 - SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is prone to multiple SQL injection, HT...

Vtiger Install Unauthenticated Remote Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Application database configuration is overwritten Rank = ManualRanking include...

Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit

No description provided by source. !/usr/bin/python INFORMATION: Exploit Title: Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit Google Dork: The honest Open Source CRM vtiger CRM 5.0.4 Date: 5/3/2011 CVE: CVE-2009-3249 Windows link: http://bit.ly/fiOYCL Linux link: http://bit.ly/hluzLf...

vtiger CRM <= 5.4.0 (SOAP Services) - Multiple Vulnerabilities

No description provided by source. --------------------------------------------------------------------------------- vtiger CRM = 5.4.0 customerportal.php Two Local File Inclusion Vulnerabilities --------------------------------------------------------------------------------- - Software Link:...

Vtiger CRM Install Script Remote Command Execution

A command execution vulnerability has been reported in Vtiger CRM. The vulnerability is due to an arbitrary command execution in install script. A remote attacker may exploit this vulnerability by overwriting the target database configuration...