Input Validation Vulnerabilities in vtiger CRM

vendor:

vtiger CRM

by:

7.5

CVSS

HIGH

Input Validation

20, 79, 98, 98

CWE

Product Name: vtiger CRM

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Input Validation Vulnerabilities in vtiger CRM

Multiple input validation vulnerabilities in vtiger CRM allow attackers to exploit SQL injection, HTML injection, cross-site scripting, and local file include vulnerabilities. These vulnerabilities can lead to administrative access, stealing username and password pairs, stealing cookie-based authentication credentials, and retrieving arbitrary local files in the context of the Web server process. The vulnerabilities are related to the ones discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project. An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues.

Mitigation:

Implement proper input validation and sanitization techniques to prevent SQL injection, HTML injection, cross-site scripting, and local file include vulnerabilities. Regularly update and patch the vtiger CRM system.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/15562/info

vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.

An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.

Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.

An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/index.php?action=DetailView&module=Leads&record=%3Cscript%3Ealert('document.cookie')%3C/script%3E