PT-2009-5562 · Vtiger · Vtiger Crm

Antonio Parata + 5 · Publicado 2009-09-18 · Atualizado 2017-09-19 · CVE-2009-3248

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.0.4

Description A cross-site request forgery issue exists in the RSS module, allowing remote attackers to hijack Admin user authentication for modifying the news feed system. This is achieved via the rssurl parameter in a Save action to "index.php".

Recommendations For vtiger CRM version 5.0.4, consider restricting access to the RSS module until a fix is available, and avoid using the rssurl parameter in Save actions to "index.php" to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-3248

Produtos afetados

Vtiger Crm

Referências · 11

• 🔥 http://ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt · Exploit
• 🔥 http://ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=125060676515670&w=2 · Exploit
• 🔥 http://securityfocus.com/bid/36062 · Exploit
• 🔥 http://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://osvdb.org/57238 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3248 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3248 · Nota
• http://secunia.com/advisories/36309 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/2319 · Aviso do Fabricante