Improper input validation in Vtiger Crm
CVE-2009-3250
The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.0 (High). Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.109 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.109 · newest: 0.109 · change: 0.000
Affected products
- Vtiger Crm — versions 5.0.4
Weakness classification (CWE)
References
- www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/ (Exploit)
- www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt (Exploit)
- www.exploit-db.com/exploits/9450 (exploit)
- marc.info/ (mailing-list)
- www.securityfocus.com/bid/36062 (Exploit, vdb-entry)
- secunia.com/advisories/36309 (Vendor Advisory, third-party-advisory)
- www.osvdb.org/57237 (vdb-entry)
- www.vupen.com/english/advisories/2009/2319 (vdb-entry, Vendor Advisory)