CVE

Id
15024  
CVE No.
CVE-2005-3820  
Status
Candidate  
Description
Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimately execute arbitrary PHP code, via .. (dot dot) and null byte ("%00") sequences in the (1) module parameter and (2) action parameter in the Leads module, as also demonstrated by injecting PHP code into log messages and accessing the log file.  
Phase
Assigned (20051126)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
116696 15024 CVE-2005-3820 BUGTRAQ:20051124 Advisory 23/2005: vTiger multiple vulnerabilities  View
116697 15024 CVE-2005-3820 URL:http://www.securityfocus.com/archive/1/archive/1/417730/30/0/threaded  View
116698 15024 CVE-2005-3820 FULLDISC:20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM  View
116699 15024 CVE-2005-3820 URL:http://marc.info/?l=full-disclosure&m=113290708121951&w=2  View
116700 15024 CVE-2005-3820 BUGTRAQ:20051125 SEC Consult SA-20051125-0 :: More Vulnerabilities in vTiger CRM  View
116701 15024 CVE-2005-3820 URL:http://www.securityfocus.com/archive/1/archive/1/417711/30/0/threaded  View
116702 15024 CVE-2005-3820 MISC:http://www.hardened-php.net/advisory_232005.105.html  View
116703 15024 CVE-2005-3820 BID:15562  View
116704 15024 CVE-2005-3820 URL:http://www.securityfocus.com/bid/15562  View
116705 15024 CVE-2005-3820 BID:15569  View
116706 15024 CVE-2005-3820 URL:http://www.securityfocus.com/bid/15569  View
116707 15024 CVE-2005-3820 VUPEN:ADV-2005-2569  View
116708 15024 CVE-2005-3820 URL:http://www.vupen.com/english/advisories/2005/2569  View
116709 15024 CVE-2005-3820 SECTRACK:1015271  View
116710 15024 CVE-2005-3820 URL:http://securitytracker.com/id?1015271  View
116711 15024 CVE-2005-3820 SECTRACK:1015274  View
116712 15024 CVE-2005-3820 URL:http://securitytracker.com/id?1015274  View
116713 15024 CVE-2005-3820 SECUNIA:17693  View

Related JVN