PT-2019-17399 · Vtiger · Vtiger Crm

Akkus + 1 · Published 2019-01-04 · Updated 2019-10-24 · CVE-2019-5009

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 7.1.0 before Hotfix2

Description The issue allows uploading files with the php3 extension in the logo upload field, under specific conditions, such as the file being in PNG format and having a size of 150x40. An attacker can embed PHP code into the image, which can be executed using <? ?> tags, as seen in the CompanyDetailsSave action. This bypasses the protection mechanism against bad file extensions. The affected files include actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.

Recommendations For Vtiger CRM version 7.1.0 before Hotfix2, apply Hotfix2 to resolve the issue. As a temporary workaround, consider restricting access to the logo upload field or disabling the execution of PHP code in uploaded images until the hotfix is applied. Avoid using the php3 extension for logo uploads until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-5009

Affected Products

Vtiger Crm

References · 6

• 🔥 https://exploit-db.com/exploits/46065 · Exploit
• 🔥 https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.html · Exploit
• http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5009 · Vendor Advisory
• http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5009 · Security Note