what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

vtiger CRM 5.40 Local File Inclusion

vtiger CRM 5.40 Local File Inclusion
Posted Aug 1, 2013
Authored by EgiX | Site karmainsecurity.com

vtiger CRM versions 5.4.0 and below suffer from multiple local file inclusion vulnerabilities in customerportal.php.

tags | advisory, local, php, vulnerability, file inclusion
advisories | CVE-2013-3212
SHA-256 | 29e3aad2d7ca794886041f23e78628f30acc7129c030d2bf78107c3a25fe0a1f

vtiger CRM 5.40 Local File Inclusion

Change Mirror Download
---------------------------------------------------------------------------------
vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities
---------------------------------------------------------------------------------


[-] Software Link:

http://www.vtiger.com/


[-] Affected Versions:

[1] All versions from 5.1.0 to 5.4.0.
[2] All versions from 5.2.0 to 5.4.0.


[-] Vulnerability Description:

1) The vulnerable code is located in the get_list_values SOAP method defined in /soap/customerportal.php:

1528. function get_list_values($id,$module,$sessionid,$only_mine='true')
1529. {
1530. require_once('modules/'.$module.'/'.$module.'.php');
1531. require_once('include/utils/UserInfoUtil.php');
1532. global $adb,$log,$current_user;
1533. $log->debug("Entering customer portal function get_list_values");

2) The vulnerable code is located in the get_project_components SOAP method defined in /soap/customerportal.php:

2778. function get_project_components($id,$module,$customerid,$sessionid) {
2779. require_once("modules/$module/$module.php");
2780. require_once('include/utils/UserInfoUtil.php');
2781.
2782. global $adb,$log;
2783. $log->debug("Entering customer portal function get_project_components ..");

The vulnerabilities exist because these methods fail to properly validate input passed through the "module"
parameter, that is being used in a call to the require_once() function (lines 1530 and 2779). This might be
exploited to include arbitrary local files containing malicious PHP code. Successful exploitation of these
vulnerabilities requires the application running on PHP < 5.3.4, because a null byte injection is required.


[-] Solution:

Apply the vendor patch:http://www.vtiger.com/blogs/?p=1467


[-] Disclosure Timeline:

[13/01/2013] - Vendor notified
[06/02/2013] - Vendor asked feedback abouthttp://trac.vtiger.com/cgi-bin/trac.cgi/changeset/13848
[05/03/2013] - Feedback provided to the vendor
[26/03/2013] - Vendor patch released
[18/04/2013] - CVE number requested
[20/04/2013] - CVE number assigned
[01/08/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-3212 to these vulnerabilities.


[-] Credits:

Vulnerabilities discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-05

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close