CVE-2013-5091

vTiger CRM 5.4.0 - 'index.php?onlyforuser' SQL Injection

Severity Score

8.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.

Vulnerabilidad de inyección SQL en CalendarCommon.php en vTiger CRM 5.4.0 y posiblemente anteriores versiones permite a atacantes remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro onlyforuser e una acción index a index.php. NOTA: este problema podría ser un duplicado del CVE-2011-4559.

vtiger CRM version 5.4.0 suffers from a remote SQL injection vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-08-08 CVE Reserved
2013-09-18 CVE Published
2013-09-20 First Exploit
2024-09-17 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (6)

URL	Tag	Source
http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html	Mailing List
http://osvdb.org/76138	Broken Link
https://www.htbridge.com/advisory/HTB23168	Third Party Advisory

URL	Date	SRC
https://www.exploit-db.com/exploits/28409	2013-09-20
http://www.exploit-db.com/exploits/28409	2024-09-17

URL	Date	SRC
http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product	2018-10-30

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				<= 5.4.0 Search vendor "Vtiger" for product "Vtiger Crm" and version " <= 5.4.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				1.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "1.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				2.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "2.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				2.0.1 Search vendor "Vtiger" for product "Vtiger Crm" and version "2.0.1"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				2.1 Search vendor "Vtiger" for product "Vtiger Crm" and version "2.1"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				3.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "3.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				3.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "3.0"		beta		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				3.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "3.2"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4"		beta		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4"		beta, it		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4"		rc1		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.0.1 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.0.1"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2"		validation		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2"		patch1		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				4.2.4 Search vendor "Vtiger" for product "Vtiger Crm" and version "4.2.4"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.0.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.0.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.0.2 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.0.2"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.0.3 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.0.3"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.0.4 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.0.4"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.0.4 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.0.4"		rc		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.1.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.1.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.1.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.1.0"		rc		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.2.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.2.0"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.2.1 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.2.1"		-		Affected
Vtiger Search vendor "Vtiger"		Vtiger Crm Search vendor "Vtiger" for product "Vtiger Crm"				5.3.0 Search vendor "Vtiger" for product "Vtiger Crm" and version "5.3.0"		-		Affected