Lucene search

MitreCVE-2009-3250

HistorySep 18, 2009 - 8:30 p.m.

CVE-2009-3250

2009-09-1820:30:00

CWE-20

mitre

web.nvd.nist.gov

vtiger crm

cve-2009-3250

code execution

security vulnerability

email attachment

apache http server

windows

linux

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

AI Score

7.3

Confidence

High

EPSS

0.055

Percentile

93.2%

JSON

The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.

Affected configurations

Nvd

Node

vtigervtiger_crmMatch5.0.4

VendorProductVersionCPE
vtigervtiger_crm5.0.4cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vtiger	vtiger_crm	5.0.4	cpe:2.3:a:vtiger:vtiger_crm:5.0.4:::::::*

References

marc.info/?l=bugtraq&m=125060676515670&w=2

secunia.com/advisories/36309

www.exploit-db.com/exploits/9450

www.osvdb.org/57237

www.securityfocus.com/bid/36062

www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/

www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt

www.vupen.com/english/advisories/2009/2319

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

AI Score

7.3

Confidence

High

EPSS

0.055

Percentile

93.2%

JSON

Related for CVE-2009-3250