Sign-up

ID

VAR-201111-0315


TITLE

vtiger CRM 'graph.php' Local file contains vulnerabilities

Trust: 0.8

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4818

DESCRIPTION

Vtiger CRM is a Web-based Sales Capability Automation (SFA)-based Customer Relationship Management System (CRM). There is a local file containing vulnerability in vtiger CRM. Since the input to graph.php via the \"module\" and \"action\" GET parameters is missing validation before being used to include the file, the attacker can include the previously uploaded file via the directory traversal sequence and the URL-encoded null bytes: http: //[host]/graph.php?module=../storage/2011/October/week3/UploadedFile.txt%00http://[host]/graph.php?module=1&action=../../storage /2011/October/week3/UploadedFile.txt%00

Trust: 0.72

sources: CNVD: CNVD-2011-4818 // IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4818

AFFECTED PRODUCTS

vendor:vtigermodel:crmscope:eqversion:5.x

Trust: 0.8

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4818

CVSS

SEVERITY

CVSSV2

CVSSV3

IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d

TYPE

Configuration issues

Trust: 0.2

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d

PATCH

title:Vtiger CRM 'graph.php' local file contains vulnerable patchesurl:https://www.cnvd.org.cn/patchinfo/show/5841

Trust: 0.6

sources: CNVD: CNVD-2011-4818

EXTERNAL IDS

db:CNVDid:CNVD-2011-4818

Trust: 0.8

db:IVDid:E077DCE4-1F7F-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: e077dce4-1f7f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4818

REFERENCES

url:https://www.htbridge.ch/advisory/local_file_inclusion_in_vtigercrm.html

Trust: 0.6

sources: CNVD: CNVD-2011-4818

SOURCES

db:IVDid:e077dce4-1f7f-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-4818

LAST UPDATE DATE

2022-05-17T02:00:10.653000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2011-4818date:2011-11-11T00:00:00

SOURCES RELEASE DATE

db:IVDid:e077dce4-1f7f-11e6-abef-000c29c66e3ddate:2011-11-11T00:00:00
db:CNVDid:CNVD-2011-4818date:2011-11-11T00:00:00