PT-2017-2023 · Vtiger · Vtiger Crm

Benjamin Daniel Mussler · Published 2017-04-14 · Updated 2018-04-02 · CVE-2016-1713

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 6.4.0

Description The issue is related to an unrestricted file upload vulnerability in the Settings Vtiger CompanyDetailsSave Action class. This allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension and then accessing it via a direct request to the file. The vulnerability exists due to an incomplete fix for a previous issue.

Recommendations For Vtiger CRM version 6.4.0, consider restricting access to the CompanyDetailsSave.php file in the modules/Settings/Vtiger/actions/ directory to prevent exploitation until a proper fix is available. As a temporary workaround, avoid using the CompanyDetailsSave Action class until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2017-01190

CVE-2016-1713

Affected Products

Vtiger Crm

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vtiger_logo_upload_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44379 · Exploit
• 🔥 http://b.fl7.de/2016/01/vtiger-crm-6.4-auth-rce.html · Exploit
• 🔥 https://exploit-db.com/exploits/38345 · Exploit
• https://bdu.fstec.ru/vul/2017-01190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1713 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1713 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/01/12/4 · Note
• http://openwall.com/lists/oss-security/2016/01/12/7 · Note