Published: 06/02/2020 Updated: 10/02/2020

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 655

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and previous versions allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vtiger vtiger crm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 # Exploit Title: Vtiger CRM <= 630 Authenticated Remote Code Execution # Date: 2015-09-28 # Exploit Author: Benjamin Daniel Mussler # Vendor Homepage: wwwvtigercom # Software Link: wwwvtigercom/open-source-downloads/ # Version: 630 (and lower) # Tested on: Linux (Ubuntu) # C ...

Vtiger CRM versions 63 and below suffer from an authenticated remote code execution vulnerability ...

CWE-434 https://www.exploit-db.com/exploits/38345/http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html http://www.securityfocus.com//archive/1/536563/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/38345/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-6000

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect