vtiger CRM is prone to multiple input-validation vulnerabilities: - A remote PHP code-execution vulnerability - Multiple local file-include vulnerabilities - A cross-site scripting vulnerability - Multiple cross-site request-forgery vulnerabilities Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions, compromise the affected application, steal cookie-based authentication credentials, or obtain information that could aid in further attacks. The issues affect vtiger CRM 5.0.4 other versions may also be affected.

Reportedly, the vendor fixed some of the issues in the latest release, but Symantec has not confirmed this information.

• http://www.securityfocus.com/archive/1/505834
• http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt
• http://www.vtiger.com/
• https://www.securityfocus.com/bid/36062

---

Updated on 2015-03-25