PT-2009-5564 · Apache+1 · Apache Http Server+1

Antonio Parata + 5 · Published 2009-09-18 · Updated 2017-09-19 · CVE-2009-3250

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.0.4

Description The issue concerns the saveForwardAttachments procedure in the Compose Mail functionality, allowing remote authenticated users to execute arbitrary code. This can be achieved by composing an e-mail message with a specifically crafted attachment filename and then making a direct request to a certain pathname under storage/. The vulnerability can be exploited in installations based on certain Apache HTTP Server configurations, and the attachment filename can end in .php, .php., or .php/ on different operating systems.

Recommendations For vtiger CRM version 5.0.4, consider restricting access to the saveForwardAttachments procedure in the Compose Mail functionality until a patch is available. As a temporary workaround, avoid using the Compose Mail functionality with attachments that have filenames ending in .php, .php., or .php/. Restrict access to the storage/ directory to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-3250

Affected Products

Apache Http Server

Vtiger Crm

References · 11

• 🔥 http://ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://securityfocus.com/bid/36062 · Exploit
• 🔥 http://exploit-db.com/exploits/9450 · Exploit
• 🔥 http://ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3250 · Security Note
• http://vupen.com/english/advisories/2009/2319 · Vendor Advisory
• http://secunia.com/advisories/36309 · Vendor Advisory
• http://osvdb.org/57237 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3250 · Note
• http://marc.info/?l=bugtraq&m=125060676515670&w=2 · Note