|
vtiger CRM Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA21728
|
|
|
Release Date:
|
2006-09-04
|
|
Last Update:
|
2008-01-18
|
|
Popularity:
|
7,683 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Partial Fix
|
|
| Software: | vtiger CRM 4.x
vtiger CRM 5.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-4587
CVE-2006-4588
CVE-2006-4617
CVE-2006-5289
|
|
Description:
Some vulnerabilities have been discovered in vtiger CRM, which can be exploited by malicious people to conduct script insertion attacks, bypass certain security restrictions, and to compromise a vulnerable system.
1) Input passed to the "description" field in various modules when e.g. creating a contact and the "solution" field when an administrator modifies the solution in the HelpDesk modules isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.
2) An error in the access control verification can be exploited by a normal user to access administrative modules (e.g. the settings section) by accessing certain URLs directly.
3) Input passed to the "calpath" parameter in modules/Calendar/admin/update.php is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or external resources.
The vulnerabilities have been confirmed in version 4.2.4. Other versions may also be affected.
Solution:
Fixed in version 5.0.4-rc4.
Provided and/or discovered by:
1,2) Ivan Markovic
3) Dedi Dwianto
Changelog:
2006-09-07: Added CVE references.
2006-09-18: Added CVE reference.
2006-10-11: Updated "Title", "Description", and "Solution" section. Added additional vulnerability provided by Dedi Dwianto. Updated "Criticality".
2006-11-14: Added CVE reference.
2008-01-18: Updated "Solution" section, added version 5.x as affected.
Original Advisory:
1,2) http://www.security-net.biz/adv/D3906a.txt
3) http://advisories.echo.or.id/adv/adv54-theday-2006.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
