Description
The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function.
References
- 20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM mailing-list
- 15569 vdb-entry
- ADV-2005-2569 vdb-entry
- 1015274 vdb-entry
- 20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM mailing-list
- 17693 third-party-advisory