Details of VAR-201310-0304

ID

VAR-201310-0304

CVE

CVE-2013-5091

TITLE

vTiger CRM of CalendarCommon.php In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2013-004517

DESCRIPTION

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559. vTiger CRM of CalendarCommon.php Is SQL An injection vulnerability exists. vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. vtiger CRM 5.4.0 is vulnerable; prior versions may also be affected. Vtiger CRM is a customer relationship management system (CRM) based on SugarCRM developed by American Vtiger Company. The management system provides functions such as management, collection, and analysis of customer information. The vulnerability is caused by the program not adequately filtering the 'onlyforuser' parameter passed to the index.php script

Trust: 1.98

sources: NVD: CVE-2013-5091 // JVNDB: JVNDB-2013-004517 // BID: 62487 // VULHUB: VHN-65093

AFFECTED PRODUCTS

vendor:	vtiger	model:	crm	scope:	eq	version:	5.2.1	Trust: 1.9
vendor:	vtiger	model:	crm	scope:	lte	version:	5.4.0	Trust: 1.8
vendor:	vtiger	model:	crm	scope:	eq	version:	5.1.0	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.3.0	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.0.3	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.2.0	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.0.4	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.0.2	Trust: 1.6
vendor:	vtiger	model:	crm	scope:	eq	version:	2.0.1	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	2.1	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	4.0	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	4.0.1	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	4.2	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	4	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	3.0	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	4.2.4	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	2.0	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	1.0	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	5.0.0	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	3.2	Trust: 1.0
vendor:	vtiger	model:	crm	scope:	eq	version:	5.4.0	Trust: 0.6
vendor:	vtiger	model:	crm	scope:	eq	version:	5.3	Trust: 0.3
vendor:	vtiger	model:	crm	scope:	eq	version:	5.2	Trust: 0.3

sources: BID: 62487 // JVNDB: JVNDB-2013-004517 // CNNVD: CNNVD-201309-373 // NVD: CVE-2013-5091

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-5091
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-5091
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201309-373
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-65093
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-5091
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-65093
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-65093 // JVNDB: JVNDB-2013-004517 // CNNVD: CNNVD-201309-373 // NVD: CVE-2013-5091

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.9

sources: VULHUB: VHN-65093 // JVNDB: JVNDB-2013-004517 // NVD: CVE-2013-5091

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201309-373

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201309-373

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-004517

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-65093

PATCH

title:	vtiger CRM 5.4.0 (Patch Information)	url:	http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/	Trust: 0.8
title:	Top Page	url:	https://www.vtiger.com/crm/	Trust: 0.8

sources: JVNDB: JVNDB-2013-004517

EXTERNAL IDS

db:	NVD	id:	CVE-2013-5091	Trust: 2.8
db:	IMMUNIWEB	id:	HTB23168	Trust: 1.7
db:	EXPLOIT-DB	id:	28409	Trust: 1.7
db:	OSVDB	id:	76138	Trust: 1.7
db:	BID	id:	62487	Trust: 1.0
db:	JVNDB	id:	JVNDB-2013-004517	Trust: 0.8
db:	CNNVD	id:	CNNVD-201309-373	Trust: 0.7
db:	BUGTRAQ	id:	20130918 SQL INJECTION IN VTIGER CRM	Trust: 0.6
db:	PACKETSTORM	id:	123296	Trust: 0.1
db:	SEEBUG	id:	SSVID-81979	Trust: 0.1
db:	VULHUB	id:	VHN-65093	Trust: 0.1

sources: VULHUB: VHN-65093 // BID: 62487 // JVNDB: JVNDB-2013-004517 // CNNVD: CNNVD-201309-373 // NVD: CVE-2013-5091

REFERENCES

url:	http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html	Trust: 2.5
url:	http://sourceforge.net/projects/vtigercrm/files/vtiger%20crm%205.4.0/core%20product/	Trust: 1.7
url:	http://www.exploit-db.com/exploits/28409	Trust: 1.7
url:	https://www.htbridge.com/advisory/htb23168	Trust: 1.7
url:	http://osvdb.org/76138	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5091	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5091	Trust: 0.8
url:	http://www.securityfocus.com/bid/62487	Trust: 0.6
url:	http://www.vtiger.com/	Trust: 0.3

sources: VULHUB: VHN-65093 // BID: 62487 // JVNDB: JVNDB-2013-004517 // CNNVD: CNNVD-201309-373 // NVD: CVE-2013-5091

CREDITS

High-Tech Bridge Security Research Lab

Trust: 0.9

sources: BID: 62487 // CNNVD: CNNVD-201309-373

SOURCES

db:	VULHUB	id:	VHN-65093
db:	BID	id:	62487
db:	JVNDB	id:	JVNDB-2013-004517
db:	CNNVD	id:	CNNVD-201309-373
db:	NVD	id:	CVE-2013-5091

LAST UPDATE DATE

2025-04-11T20:17:34.459000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-65093	date:	2018-10-30T00:00:00
db:	BID	id:	62487	date:	2013-09-18T00:00:00
db:	JVNDB	id:	JVNDB-2013-004517	date:	2013-10-08T00:00:00
db:	CNNVD	id:	CNNVD-201309-373	date:	2013-10-08T00:00:00
db:	NVD	id:	CVE-2013-5091	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-65093	date:	2013-10-04T00:00:00
db:	BID	id:	62487	date:	2013-09-18T00:00:00
db:	JVNDB	id:	JVNDB-2013-004517	date:	2013-10-08T00:00:00
db:	CNNVD	id:	CNNVD-201309-373	date:	2013-09-24T00:00:00
db:	NVD	id:	CVE-2013-5091	date:	2013-10-04T20:55:03.857