Join our subscribers
Local File Inclusion Vulnerabilities in vtiger CRM
| Advisory ID: | HTB23054 |
| Product: | vtiger CRM |
| Vendor: | vtiger |
| Vulnerable Versions: | 5.2.1 and probably prior |
| Tested Version: | 5.2.1 |
| Advisory Publication: | October 19, 2011 [without technical details] |
| Vendor Notification: | October 19, 2011 |
| Public Disclosure: | November 9, 2011 |
| Latest Update: | October 31, 2011 |
| Vulnerability Type: | PHP File Inclusion [CWE-98] |
| Risk Level: | High |
 | |
| CVSSv2 Base Score: | 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in vtiger CRM which could be exploited to perform gain access to sensitive information and compromise vulnerable system. | |
| Solution: | |
| Upgrade to the most recent version http://vtiger.com/blogs/?p=894 | |
References: | |
| [1] High-Tech Bridge Advisory HTB23054 - https://www.immuniweb.com/advisory/HTB23054 - Local File Inclusion Vulnerabilities in vtiger CRM [2] VtigerCRM - vtiger.com – vtiger CRM is a on demand customer relationship management software that provides sales, marketing, and support teams with powerful tools to efficiently and effectively collaborate in providing the ideal customer experience. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
