PT-2017-2023 · Vtiger · Vtiger Crm

Benjamin Daniel Mussler · Publicado 2017-04-14 · Atualizado 2018-04-02 · CVE-2016-1713

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 6.4.0

Description The issue is related to an unrestricted file upload vulnerability in the Settings Vtiger CompanyDetailsSave Action class. This allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension and then accessing it via a direct request to the file. The vulnerability exists due to an incomplete fix for a previous issue.

Recommendations For Vtiger CRM version 6.4.0, consider restricting access to the CompanyDetailsSave.php file in the modules/Settings/Vtiger/actions/ directory to prevent exploitation until a proper fix is available. As a temporary workaround, avoid using the CompanyDetailsSave Action class until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2017-01190

CVE-2016-1713

Produtos afetados

Vtiger Crm

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vtiger_logo_upload_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44379 · Exploit
• 🔥 http://b.fl7.de/2016/01/vtiger-crm-6.4-auth-rce.html · Exploit
• 🔥 https://exploit-db.com/exploits/38345 · Exploit
• https://bdu.fstec.ru/vul/2017-01190 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/01/12/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1713 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/01/12/7 · Nota
• https://osv.dev/vulnerability/CVE-2016-1713 · Aviso do Fabricante