CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19202
https://notcve.org/view.php?id=CVE-2019-19202
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request. En Vtiger versiones 7.x anteriores a 7.2.0, la funcionalidad de guardado en My Preferences permite a un usuario sin privilegios administrativos cambiar su propio rol agregando roleid=H2 a una petición POST. • http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html https://code.vtiger.com/vtiger/vtigercrm/issues/1126 • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8047
https://notcve.org/view.php?id=CVE-2018-8047
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List (app parameter). vtiger CRM 7.0.1 está afectado por una vulnerabilidad reflejada de secuencias de comandos entre sitios (XSS) que afecta a la versión 7.0.1 y probablemente a las versiones anteriores. Esta vulnerabilidad podría permitir a los atacantes remotos no identificados inyectar un script web o HTML arbitrario a través de index.php? Module = Contacts & view = List (parámetro de la aplicación). • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10754
https://notcve.org/view.php?id=CVE-2016-10754
modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter. En Vtiger CRM versión 6.5.0, el archivo modules/Calendar/Activity.php permite la inyección de SQL por medio del parámetro contactidlist. • https://blog.ripstech.com/2016/vtiger-sql-injection https://demo.ripstech.com/projects/vtiger_6.5.0 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2019-11057
https://notcve.org/view.php?id=CVE-2019-11057
SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. La vulnerabilidad de la inyección de SQL en Vtiger CRM antes de la revisión 7.1.03 permite a los usuarios autenticados ejecutar comandos SQL arbitrarios. • http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html https://cybersecurityworks.com/zerodays/cve-2019-11057-vtiger.html https://medium.com/%40mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 7%CPEs: 2EXPL: 2CVE-2019-5009 – Vtiger CRM 7.1.0 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-5009
Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. • https://www.exploit-db.com/exploits/46065 http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375 http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.html https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.html • CWE-434: Unrestricted Upload of File with Dangerous Type •