Lucene search

[email protected]CVE-2013-3213

HistoryApr 02, 2014 - 4:05 p.m.

CVE-2013-3213

2014-04-0216:05:49

CWE-89

[email protected]

web.nvd.nist.gov

cve

2013

3213

sql injection

vtiger crm

security vulnerability

nvd

remote execution

arbitrary commands

soap protocol

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.6 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.6%

JSON

Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php, or (3) emailaddress parameter in the SearchContactsByEmail method to soap/vtigerolservice.php; or remote authenticated users to execute arbitrary SQL commands via the (4) emailaddress parameter in the SearchContactsByEmail method to soap/thunderbirdplugin.php.

Affected configurations

NVD

Node

vtigervtiger_crmMatch5.0.0

vtigervtiger_crmMatch5.0.1

vtigervtiger_crmMatch5.0.2

vtigervtiger_crmMatch5.0.3

vtigervtiger_crmMatch5.0.4

vtigervtiger_crmMatch5.0.4rc

vtigervtiger_crmMatch5.1.0

vtigervtiger_crmMatch5.1.0rc

vtigervtiger_crmMatch5.2.0

vtigervtiger_crmMatch5.2.1

vtigervtiger_crmMatch5.3.0

vtigervtiger_crmMatch5.4.0

CPENameOperatorVersion
vtiger:vtiger_crmvtiger vtiger crmeq5.0.0
vtiger:vtiger_crmvtiger vtiger crmeq5.0.1
vtiger:vtiger_crmvtiger vtiger crmeq5.0.2
vtiger:vtiger_crmvtiger vtiger crmeq5.0.3
vtiger:vtiger_crmvtiger vtiger crmeq5.0.4
vtiger:vtiger_crmvtiger vtiger crmeq5.1.0
vtiger:vtiger_crmvtiger vtiger crmeq5.2.0
vtiger:vtiger_crmvtiger vtiger crmeq5.2.1
vtiger:vtiger_crmvtiger vtiger crmeq5.3.0
vtiger:vtiger_crmvtiger vtiger crmeq5.4.0

CPE	Name	Operator	Version
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.0.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.0.1
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.0.2
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.0.3
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.0.4
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.1.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.2.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.2.1
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.3.0
vtiger:vtiger_crm	vtiger vtiger crm	eq	5.4.0