Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 30/04/2024 Updated: 30/04/2024

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated malicious user to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).

Authenticated Remote Code Execution in in VTiger Open Source CRM v7.5

CVE-2023-46304 Authenticated Remote Code Execution in in VTiger Open Source CRM v75 Summary A vulnerability exists in the Users module in the current release of VTiger CRM Open Source version 750 which allows an authenticated attacker to write and execute arbitrary PHP code to configincphp Exploit Details When a user is authenticated in VTiger normally, it checks their se

https://www.vtiger.com/https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php https://github.com/jselliott/CVE-2023-46304 https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 https://nvd.nist.gov https://github.com/jselliott/CVE-2023-46304

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-46304

Vulnerability Summary

Github Repositories

References

Vulmon Search

About

Products

Connect