// For flags

CVE-2019-5009

Vtiger CRM 7.1.0 - Remote Code Execution

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. It is related to actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.

La versión 7.1.0 de Vtiger CRM anterior a Hotfix2 permite la subida de archivos con la extensión "php3" en el campo de subida de logos, si el archivo subido tiene el formato PNG y el tamaño de 150x40. Se puede introducir código PHP en la imagen; este código puede ejecutarse mediante etiquetas "", tal y como queda demostrado con una acción de CompanyDetailsSave. Esto omite el mecanismo de protección de las extensiones de archivos maliciosos. Está relacionado con actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php y models/CompanyDetails.php.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-04 CVE Reserved
  • 2019-01-04 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-09-16 First Exploit
  • 2024-09-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vtiger
Search vendor "Vtiger"
 Vtiger Crm
Search vendor "Vtiger" for product "Vtiger Crm"
 <= 7.1.0
Search vendor "Vtiger" for product "Vtiger Crm" and version " <= 7.1.0"
-
Affected
Vtiger
Search vendor "Vtiger"
 Vtiger Crm
Search vendor "Vtiger" for product "Vtiger Crm"
 7.1.0
Search vendor "Vtiger" for product "Vtiger Crm" and version "7.1.0"
hotfix1
Affected