This host is installed with vTiger CRM and is prone to xss and sql injection vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary HTML or script code and inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. Impact Level: Application

Apply the patch from the below link or upgrade to version 6.0 or later, For patch refer to http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product For updates refer to http://www.vtiger.com ***** NOTE: Ignore this warning, if above mentioned patch is manually applied. *****

Flaw is due to the /index.php script not properly sanitizing user-supplied input to the 'onlyforuser' parameter and savetemplate.php, deletetask.php, edittask.php, savetask.php and saveworkflow.php scripts are not properly sanitizing the input passed via the 'return_url' parameter.

vTiger CRM version 5.4.0 and prior.

Get the installed version with the help of detect NVT and check the version is vulnerable or not.

• http://seclists.org/bugtraq/2013/Sep/78
• http://www.exploit-db.com/exploits/28409
• https://www.htbridge.com/advisory/HTB23168
• https://www.vtiger.com/blogs/?p=1467

---

Updated on 2017-03-28