module
Vtiger CRM - Authenticated Logo Upload RCE
Disclosed | Created |
---|---|
2015-09-28 | 2019-03-19 |
Disclosed
2015-09-28
Created
2019-03-19
Description
Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo.
Instead of uploading an image, an attacker may choose to upload a file containing PHP code and
run this code by accessing the resulting PHP file.
This module was tested against vTiger CRM v6.3.0.
Instead of uploading an image, an attacker may choose to upload a file containing PHP code and
run this code by accessing the resulting PHP file.
This module was tested against vTiger CRM v6.3.0.
Authors
Benjamin Daniel Mussler
Touhid M.Shaikh touhidshaikh22@gmail.com
SecureLayer7.net
Touhid M.Shaikh touhidshaikh22@gmail.com
SecureLayer7.net
Platform
PHP
Architectures
php
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.