CVE-2013-5091

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559...

Sql injection

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559...

CVE-2013-5091

The CVE affects vtiger CRM (CalendarCommon.php) where SQL injection is possible via the onlyforuser parameter passed to index.php. Affected: vtiger CRM 5.4.0 and likely earlier. Root cause: insufficient validation of the onlyforuser input leading to arbitrary SQL execution; exploitation requires ...

CVE-2013-5091

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559...

SQL Injection in vtiger CRM

Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

vTiger CRM 5.4.0 - index.php?onlyforuser SQL Injection

vTiger CRM 5.4.0 - index.php?onlyforuser SQL Injection Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013...

vTiger CRM 5.4.0 - 'index.php?onlyforuser' SQL Injection

Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

vtiger CRM 5.4.0 SQL Injection Vulnerability

vtiger CRM version 5.4.0 suffers from a remote SQL injection vulnerability. Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerabili...

vtiger CRM 5.4.0 SQL Injection

Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

[KIS-2013-07] vtiger CRM <= 5.4.0 (vtigerolservice.php) PHP Code Injection Vulnerability

-------------------------------------------------------------------------- vtiger CRM = 5.4.0 vtigerolservice.php PHP Code Injection Vulnerability -------------------------------------------------------------------------- - Software Link: http://www.vtiger.com/ - Affected Versions: All versions...

[KIS-2013-08] vtiger CRM <= 5.4.0 (SOAP Services) Authentication Bypass Vulnerability

----------------------------------------------------------------------- vtiger CRM = 5.4.0 SOAP Services Authentication Bypass Vulnerability ----------------------------------------------------------------------- - Software Link: http://www.vtiger.com/ - Affected Versions: All versions from 5.1.0...

[KIS-2013-06] vtiger CRM <= 5.4.0 (SOAP Services) Multiple SQL Injection Vulnerabilities

-------------------------------------------------------------------------- vtiger CRM = 5.4.0 SOAP Services Multiple SQL Injection Vulnerabilities -------------------------------------------------------------------------- - Software Link: http://www.vtiger.com/ - Affected Versions: All versions...

[KIS-2013-05] vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities

--------------------------------------------------------------------------------- vtiger CRM = 5.4.0 customerportal.php Two Local File Inclusion Vulnerabilities --------------------------------------------------------------------------------- - Software Link: http://www.vtiger.com/ - Affected...

SQL Injection in vtiger CRM

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in vtiger CRM, which can be exploited to execute arbitrary SQL commands in application's database. 1 SQL Injection in vtiger CRM: CVE-2013-5091 The vulnerability exists due to insufficient validation of "onlyforuser" HT...

vtiger CRM <= 5.4.0 (SOAP Services) - Multiple Vulnerabilities

Exploit for php platform in category web applications 1 The vulnerable code is located in the getlistvalues SOAP method defined in /soap/customerportal.php: 1528. function getlistvalues$id,$module,$sessionid,$onlymine='true' 1529. 1530. requireonce'modules/'.$module.'/'.$module.'.php'; 1531...

vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities

vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities --------------------------------------------------------------------------------- vtiger CRM debug"Entering customer portal function getlistvalues"; 2 The vulnerable code is located in the getprojectcomponents SOAP method defined in...

vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities

--------------------------------------------------------------------------------- vtiger CRM debug"Entering customer portal function getlistvalues"; 2 The vulnerable code is located in the getprojectcomponents SOAP method defined in /soap/customerportal.php: 2778. function...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

vTiger CRM allows a user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This module has been tested successfully on...

CVE-2012-4867

Directory traversal vulnerability in modules/comvtigerworkflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. dot dot in the modulename parameter...

CVE-2012-4867

CVE-2012-4867 affects vtiger CRM 5.1.0: directory traversal via .. in the module_name parameter of sortfieldsjson.php allows reading arbitrary files (Local File Include). Root cause: unsanitized user input. Several connected sources (Red Hat, NVD, CIRCL, OpenVAS, etc.) consistently describe a VTi...