Description
Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username in the login form or (2) record parameter, as demonstrated in the EditView action for the Contacts module.
References
- 20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM mailing-list
- 15569 vdb-entry
- ADV-2005-2569 vdb-entry
- 203 third-party-advisory
- 1015274 vdb-entry
- 20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM mailing-list
- 17693 third-party-advisory