ID de Prueba:	1.3.6.1.4.1.25623.1.0.804055
Categoría:	Web application abuses
Título:	vTiger CRM Cross Site Scripting and SQL Injection Vulnerabilities
Resumen:	This host is installed with vTiger CRM and is prone to xss and sql injection; vulnerabilities.
Descripción:	Summary: This host is installed with vTiger CRM and is prone to xss and sql injection vulnerabilities. Vulnerability Insight: Flaw is due to the /index.php script not properly sanitizing user-supplied input to the 'onlyforuser' parameter and savetemplate.php, deletetask.php, edittask.php, savetask.php and saveworkflow.php scripts are not properly sanitizing the input passed via the 'return_url' parameter. Vulnerability Impact: Successful exploitation will allow attacker to execute arbitrary HTML or script code and inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. Affected Software/OS: vTiger CRM version 5.4.0 and prior. Solution: Update to version 6.0 or later. Alternatively apply the referenced security patch for 5.4.0. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Referencia Cruzada:	BugTraq ID: 62487 Common Vulnerability Exposure (CVE) ID: CVE-2013-5091 Bugtraq: 20130918 SQL Injection in vtiger CRM (Google Search) http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html http://www.exploit-db.com/exploits/28409 https://www.htbridge.com/advisory/HTB23168 http://osvdb.org/76138
Copyright	Copyright (C) 2014 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.