653 matches found
Vtiger Install Unauthenticated Remote Command Execution
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Vtiger Install Unauthenticated Remote Command Execution', 'Description' = %q This module exploits an arbitrary command execution...
CVE-2013-3213
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...
Sql injection
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...
CVE-2013-3213
CVE-2013-3213 affects vtiger CRM 5.0.0–5.4.0, exposing multiple SQL injection vectors via SOAP services. Vulnerable code paths include get_picklists in /soap/customerportal.php, get_tickets_list in /soap/customerportal.php, and SearchContactsByEmail in /soap/thunderbirdplugin.php and /soap/vtiger...
CVE-2013-3213
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...
vTiger CRM 5.4.0 kcfinder File Upload
File upload vulnerability in vtiger CRM kcfinder component Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
vTiger CRM 5.4.0 kcfinder LFI
Local file include vulnerability in vtiger CRM kcfinder component Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...
Vtiger CRM文件包含漏洞
CVE ID：CVE-2014-1222 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 本地文件包含漏洞被发现在vtigerCRM 6.0 RC的'kcfinder'组件。攻击者可以利用漏洞通过目录遍历序列包含任意文件，并泄漏任意文件内容。 0 Vtiger CRM 5.4.0 Vtiger CRM 6.0 RC Vtiger CRM 6.0.0 GA 厂商补丁： vtiger CRM ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.vtiger.com/ POST...
vTiger CRM 5.4.06.0 RC6.0.0 GA - browse.php Local File Inclusion
vTiger CRM 5.4.06.0 RC6.0.0 GA - browse.php Local File Inclusion CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in...
Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA - Local File Inclusion Vulnerability
Vtiger CRM versions 5.4.0, 6.0 RC, and 6.0.0 GA suffer from a local file inclusion vulnerability. CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusio...
vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion
CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be...
Vtiger CRM 5.4.0 / 6.0 RC / 6.0.0 GA Local File Inclusion
Vulnerability title: Local File Inclusion in Vtiger CRM CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger CRM 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger CRM 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in...
vtiger CRM 5.4.0 get_tickets_list SQLi
SQL Injection vulnerability in vtiger CRM getticketslist SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
vtiger CRM 5.4.0 get_picklists SQLi
SQL Injection vulnerability in vtiger CRM getpicklists SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
vtiger CRM 5.4.0 File Upload
File upload vulnerability in vtiger CRM SOAP AddEmailAttachment service Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
Vtiger Install Unauthenticated Remote Command Execution
This module exploits an arbitrary command execution vulnerability in the Vtiger install script. This module is set to ManualRanking due to this module overwriting the target database configuration, which may result in a broken web app, and you may not be able to get a session again. Module Option...
vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload (CVE-2013-3215)
A remote code execution vulnerability has been reported in VTiger CRM.The vulnerability is due to lack of validation of file types uploaded to the server throught the AddEmailAttachment SOAP service. A remote attacker can exploit this vulnerability to access the script remotely and have it run th...
CVE-2013-7326
Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...
Cross site scripting
Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...
CVE-2013-7326
Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...