vendor:
Vtiger CRM
by:
Benjamin Daniel Mussler, Touhid M.Shaikh
7.3
CVSS
HIGH
Arbitrary File Upload
434
CWE
Product Name: Vtiger CRM
Affected Version From: 6.3.2000
Affected Version To: 6.3.2000
Patch Exists: NO
Related CWE: CVE-2015-6000, CVE-2016-1713
CPE: a:vtiger:vtiger_crm:6.3.0
Platforms Tested: php
2015
Vtiger CRM 6.3.0 – Authenticated Arbitrary File Upload
Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against vTiger CRM v6.3.0.
Mitigation:
Update to the latest version of vTiger CRM.