PT-2005-4571 · Vtiger · Vtiger Crm

Christopher Kunz + 1 · Published 2005-11-26 · Updated 2018-10-19 · CVE-2005-3823

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 4.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval() function.

Recommendations For versions 4.2 and earlier, consider restricting access to the Users module until a fix is available. As a temporary workaround, avoid using the templatename parameter in the affected module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3823

Affected Products

Vtiger Crm

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-3823 · Security Note
• http://secunia.com/advisories/17693 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3823 · Note
• http://securityfocus.com/bid/15569 · Note
• http://marc.info/?l=full-disclosure&m=113290708121951&w=2 · Note
• http://vupen.com/english/advisories/2005/2569 · Note
• http://securityfocus.com/archive/1/417711/30/0/threaded · Note
• http://securitytracker.com/id?1015274 · Note