CVEvulnerability

CVE-2010-3909

6.0 MEDIUM Published 2010-11-26 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-11-26
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

Affected configurations

• vtiger vtiger crm • vtiger vtiger crm (<= 5.2.0) • vtiger vtiger crm 1.0 • vtiger vtiger crm 2.0 • vtiger vtiger crm 2.0.1 • vtiger vtiger crm 2.1 • vtiger vtiger crm 3 • vtiger vtiger crm 3.0 • vtiger vtiger crm 3.2 • vtiger vtiger crm 4 • vtiger vtiger crm 4.0 • vtiger vtiger crm 4.0.1 • vtiger vtiger crm 4.2 • vtiger vtiger crm 4.2.4 • vtiger vtiger crm 5.0.0 • vtiger vtiger crm 5.0.2 • vtiger vtiger crm 5.0.3 • vtiger vtiger crm 5.0.4 • vtiger vtiger crm 5.1.0

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References