Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An authenticated attacker can upload a file on vtiger CRM, in
order to execute PHP code.

Impacted products: vtiger CRM

Severity: 2/4

Creation date: 31/10/2013

DESCRIPTION OF THE VULNERABILITY

The vtiger CRM product allows authenticated users to upload images.

However, an attacker can upload a file with the ".php3" extension.
He can then access to this file, which is interpreted as a PHP
language file.

An authenticated attacker can therefore upload a file on vtiger
CRM, in order to execute PHP code.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/vtiger-CRM-PHP-code-execution-13676