PT-2011-4987 · Vtiger · Vtiger Crm

Aung Khant · Publicado 2011-11-28 · Atualizado 2018-10-09 · CVE-2011-4559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 5.2.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the onlyforuser parameter in an index action to the "index.php" endpoint.

Recommendations For versions 5.2.1 and earlier, consider restricting access to the Calendar module until a patch is available. As a temporary workaround, avoid using the onlyforuser parameter in the index action to the "index.php" endpoint.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-4559

Produtos afetados

Vtiger Crm

Referências · 9

• 🔥 http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_blind_sqlin · Exploit
• 🔥 http://securityfocus.com/bid/49948 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2011/Oct/224 · Exploit
• 🔥 https://exploit-db.com/exploits/36208 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4559 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70344 · Nota
• http://securityfocus.com/archive/1/520006/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4559 · Nota de Segurança
• http://osvdb.org/76138 · Nota