OSVDB ID: 28459 Title: vtiger CRM fileupload.html Arbitrary PHP Code Execution |
Info |
|
|
Dates |
||||
|
|
Description |
vtiger CRM contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the 'fileupload.html' script not properly checking user privileges and not sanitizing input supplied to the script. This may allow an attacker to upload files that can contain arbitrary commands which can then subsequently be executed by the attacker. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Unknown OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
|