vtiger CRM 5.4.0 get_picklists SQLi

SQL Injection vulnerability in vtiger CRM getpicklists SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

vtiger CRM 5.4.0 File Upload

File upload vulnerability in vtiger CRM SOAP AddEmailAttachment service Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Vtiger Install Unauthenticated Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Vtiger install script. This module is set to ManualRanking due to this module overwriting the target database configuration, which may result in a broken web app, and you may not be able to get a session again. Module Option...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload (CVE-2013-3215)

A remote code execution vulnerability has been reported in VTiger CRM.The vulnerability is due to lack of validation of file types uploaded to the server throught the AddEmailAttachment SOAP service. A remote attacker can exploit this vulnerability to access the script remotely and have it run th...

CVE-2013-7326

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

Cross site scripting

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

CVE-2013-7326

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

CVE-2013-7326

Vtiger CRM 5.4.0 is affected by multiple cross-site scripting (XSS) flaws. The issue arises from unsanitized input in the return_url parameter to modules/vtiger_workflow/savetemplate.php and in endpoints deletetask.php, edittask.php, savetask.php, and saveworkflow.php, allowing injection of arbit...

PT-2014-3366 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: vTiger CRM version 5.4.0 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the return url parameter to the "modulescom vtiger workflowsavetemplate.php"...

Vtiger CRM 5.0.0 - 5.4.0 PHP Code Injection Vulnerability

Vtiger CRM is prone to a PHP code injection vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

Vtiger CRM 5.1.0 - 5.4.0 Authentication Bypass Vulnerability - Active Check

Vtiger CRM is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

[SOJOBO-ADV-13-05] - Vtiger 5.4.0 Reflected Cross Site Scripting

SOJOBO-ADV-13-05 - Vtiger 5.4.0 Reflected Cross Site Scripting I. Information ================== Name : Vtiger 5.4.0 Reflected Cross Site Scripting Software : Vtiger 5.4.0 and possibly below. Vendor Homepage : https://www.vtiger.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity :...

vTiger CRM SOAP AddEmailAttachment任意文件上传漏洞

BUGTRAQ ID：61558 CVE ID：CVE-2013-3214 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 vtiger CRM /soap/vtigerolservice.php所定义的AddEmailAttachment SOAP方法不正确过滤通过"filedata"和"filename"参数提交的输入，允许攻击者利用漏洞写/覆盖任意文件，并以WEB权限执行。 0 vtiger vtiger CRM 5.0.0 - 5.4.0 厂商补丁： vtiger ----- 用户可参考如下厂商提供的安全补丁以修复此漏洞：...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload', 'Description' = %q vTiger CRM allows an user to...

vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload', 'Description' = %q vTiger CRM allows an user to...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload Vulnerability

vTiger CRM allows an user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This Metasploit module has been tested...