Vtiger · Vtiger Crm · CVE-2008-3101
Name of the Vulnerable Software and Affected Versions:
vtiger CRM version 5.0.4
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in different modules. The affected parameters include the `parenttab` parameter in the Products module, the `user password` parameter in the Users module, and the `query string` parameter in the Home module, all of which are accessible through `index.php`.
Recommendations:
For vtiger CRM version 5.0.4, consider disabling access to the vulnerable parameters `parenttab`, `user password`, and `query string` in their respective modules until a patch is available. Restrict access to the Products, Users, and Home modules to minimize the risk of exploitation. Avoid using the `parenttab`, `user password`, and `query string` parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.