Published: 12/08/2014 Updated: 09/10/2018

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

VMScore: 415

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM prior to 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vtiger vtiger crm

# Exploit Title: FiyoCMS Multiple Vulnerabilities # Date: 29 March 2015 # Exploit Author: Mahendra # Vendor Homepage: wwwfiyoorg # Software Link: sourceforgenet/projects/fiyo-cms/ # Version: 2018, other version might be vulnerable # Tested : Kali Linux 109a-amd64 # CVE(s): CVE-2014-9145,CVE-2014-9146,CVE-2014-9147,CVE-2014-9148 *Ad ...

CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 540, 60 RC & 600 GA Fixed version: Vtiger 600 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 60 RC This could be exploited to include arbitrary files ...

--------------------------------------------------- # Exploit Title: KCFinder Local File Disclosure # Author: DaOne # Vendor Homepage: kcfindersunhatercom/ # Category: webapps/php # Version: 251 + old versions # Google dork: inurl:kcfinder/browsephp --------------------------------------------------- [#] Tested on their own demo -P ...

FiyoCMS version 2018 suffers from url bypass, cross site scripting, and remote SQL injection vulnerabilities ...

Vtiger CRM versions 540, 60 RC, and 600 GA suffer from a local file inclusion vulnerability ...

CWE-22 http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%206.0.0/Add-ons/vtigercrm-600-security-patch1.zip/download https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1222/http://www.securityfocus.com/archive/1/531423/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/36581/

CVE-2014-1222

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect