PT-2011-4987 · Vtiger · Vtiger Crm

Aung Khant · Published 2011-11-28 · Updated 2018-10-09 · CVE-2011-4559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 5.2.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the onlyforuser parameter in an index action to the "index.php" endpoint.

Recommendations For versions 5.2.1 and earlier, consider restricting access to the Calendar module until a patch is available. As a temporary workaround, avoid using the onlyforuser parameter in the index action to the "index.php" endpoint.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-4559

Affected Products

Vtiger Crm

References · 9

• 🔥 http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_blind_sqlin · Exploit
• 🔥 http://securityfocus.com/bid/49948 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2011/Oct/224 · Exploit
• 🔥 https://exploit-db.com/exploits/36208 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4559 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4559 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70344 · Note
• http://securityfocus.com/archive/1/520006/100/0/threaded · Note
• http://osvdb.org/76138 · Note