CVE-2011-4559 SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.p...
HighCVSS 7.5
EPSS 1.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vtiger crm | <= 5.2.1 | No fix listed |
| vtiger crm | = 1.0 | No fix listed |
| vtiger crm | = 2.0 | No fix listed |
| vtiger crm | = 2.0.1 | No fix listed |
| vtiger crm | = 2.1 | No fix listed |
| vtiger crm | = 3.0 | No fix listed |
| vtiger crm | = 3.0-beta | No fix listed |
| vtiger crm | = 3.2 | No fix listed |
| vtiger crm | = 4.0 | No fix listed |
| vtiger crm | = 4.0.1 | No fix listed |
| vtiger crm | = 4.2 | No fix listed |
| vtiger crm | = 4.2.4 | No fix listed |
| vtiger crm | = 5.0.2 | No fix listed |
| vtiger crm | = 5.0.3 | No fix listed |
| vtiger crm | = 5.0.4 | No fix listed |
| vtiger crm | = 5.0.4-rc | No fix listed |
| vtiger crm | = 5.1.0 | No fix listed |
| vtiger crm | = 5.1.0-rc | No fix listed |
| vtiger crm | = 5.2.0 | No fix listed |
References
- 76138 vdb-entry
- 20111005 vTiger CRM 5.2.x <= Blind SQL Injection Vulnerability exploit mailing-list
- 20111005 vTiger CRM 5.2.x <= Blind SQL Injection Vulnerability mailing-list
- 49948 exploit vdb-entry
- yehg.net exploit
- vtigercrm-index-sql-injection(70344) vdb-entry