PT-2005-4572 · Vtiger · Vtiger Crm

Christopher Kunz + 1 · Published 2005-11-26 · Updated 2018-10-19 · CVE-2005-3824

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 4.2 and earlier

Description The issue allows remote attackers to upload arbitrary files, including PHP files, via the add2db action in the uploads module.

Recommendations For versions 4.2 and earlier, consider disabling the uploads module or restricting file uploads to minimize the risk of exploitation until a patch is available.

Fix

Related Identifiers

CVE-2005-3824

Affected Products

Vtiger Crm

References · 8

• http://secunia.com/advisories/17693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3824 · Security Note
• http://securityfocus.com/bid/15569 · Note
• http://vupen.com/english/advisories/2005/2569 · Note
• http://marc.info/?l=full-disclosure&m=113290708121951&w=2 · Note
• http://securityfocus.com/archive/1/417711/30/0/threaded · Note
• http://securitytracker.com/id?1015274 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3824 · Note