vtiger CRM 'customerportal.php' Multiple Local File Include Vulnerabilities

Bugtraq ID:	61560
Class:	Input Validation Error
CVE:	CVE-2013-3212
Remote:	Yes
Local:	No
Published:	Aug 01 2013 12:00AM
Updated:	Aug 01 2013 12:00AM
Credit:	Egidio Romano
Vulnerable:	vtiger vtiger CRM 5.3 vtiger vtiger CRM 5.2.1 vtiger vtiger CRM 5.2 vtiger vtiger CRM 5.1
Not Vulnerable:

vtiger CRM 'customerportal.php' Multiple Local File Include Vulnerabilities

vtiger CRM is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings to view files and execute local script code in the context of the web server process. This may allow the attacker to compromise the application; other attacks are also possible.

vtiger CRM 5.4.0 and prior are vulnerable.

vtiger CRM 'customerportal.php' Multiple Local File Include Vulnerabilities

Attackers can exploit these issues through a browser.

vtiger CRM 'customerportal.php' Multiple Local File Include Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

vtiger CRM 'customerportal.php' Multiple Local File Include Vulnerabilities

References:

• vtiger Homepage (vtiger)