PT-2019-17399 · Vtiger · Vtiger Crm

Akkus + 1 · Publicado 2019-01-04 · Atualizado 2019-10-24 · CVE-2019-5009

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 7.1.0 before Hotfix2

Description The issue allows uploading files with the php3 extension in the logo upload field, under specific conditions, such as the file being in PNG format and having a size of 150x40. An attacker can embed PHP code into the image, which can be executed using <? ?> tags, as seen in the CompanyDetailsSave action. This bypasses the protection mechanism against bad file extensions. The affected files include actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.

Recommendations For Vtiger CRM version 7.1.0 before Hotfix2, apply Hotfix2 to resolve the issue. As a temporary workaround, consider restricting access to the logo upload field or disabling the execution of PHP code in uploaded images until the hotfix is applied. Avoid using the php3 extension for logo uploads until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-5009

Produtos afetados

Vtiger Crm

Referências · 6

• 🔥 https://exploit-db.com/exploits/46065 · Exploit
• 🔥 https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.html · Exploit
• http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5009 · Aviso do Fabricante
• http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5009 · Nota de Segurança