PT-2009-5562 · Vtiger · Vtiger Crm

Antonio Parata + 5 · Published 2009-09-18 · Updated 2017-09-19 · CVE-2009-3248

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.0.4

Description A cross-site request forgery issue exists in the RSS module, allowing remote attackers to hijack Admin user authentication for modifying the news feed system. This is achieved via the rssurl parameter in a Save action to "index.php".

Recommendations For vtiger CRM version 5.0.4, consider restricting access to the RSS module until a fix is available, and avoid using the rssurl parameter in Save actions to "index.php" to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-3248

Affected Products

Vtiger Crm

References · 11

• 🔥 http://ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt · Exploit
• 🔥 http://ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=125060676515670&w=2 · Exploit
• 🔥 http://securityfocus.com/bid/36062 · Exploit
• 🔥 http://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://osvdb.org/57238 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3248 · Security Note
• http://secunia.com/advisories/36309 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2319 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3248 · Note