CVE-2010-3909

State: Published
Severity: Not scored
Published: Nov 26, 2010
Updated: Aug 7, 2024
Reserved: Oct 12, 2010

Description

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
42246third-party-advisory
http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
20101116 Vtiger CRM 5.2.0 Multiple Vulnerabilitiesmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.