Home page logo
/

bugtraq logo Bugtraq mailing list archives

[KIS-2013-05] vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities
From: Egidio Romano <research () karmainsecurity com>
Date: Thu, 01 Aug 2013 07:57:48 +0200

---------------------------------------------------------------------------------
vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities
---------------------------------------------------------------------------------


[-] Software Link:

http://www.vtiger.com/


[-] Affected Versions:

[1] All versions from 5.1.0 to 5.4.0.
[2] All versions from 5.2.0 to 5.4.0.


[-] Vulnerability Description:

1) The vulnerable code is located in the get_list_values SOAP method defined in /soap/customerportal.php:

1528.   function get_list_values($id,$module,$sessionid,$only_mine='true')
1529.   {
1530.           require_once('modules/'.$module.'/'.$module.'.php');
1531.           require_once('include/utils/UserInfoUtil.php');
1532.           global $adb,$log,$current_user;
1533.           $log->debug("Entering customer portal function get_list_values");

2) The vulnerable code is located in the get_project_components SOAP method defined in /soap/customerportal.php:

2778.   function get_project_components($id,$module,$customerid,$sessionid) {
2779.           require_once("modules/$module/$module.php");
2780.           require_once('include/utils/UserInfoUtil.php');
2781.   
2782.           global $adb,$log;
2783.           $log->debug("Entering customer portal function get_project_components ..");

The vulnerabilities exist because these methods fail to properly validate input passed through the "module"
parameter, that is being used in a call to the require_once() function (lines 1530 and 2779). This might be
exploited to include arbitrary local files containing malicious PHP code. Successful exploitation of these
vulnerabilities requires the application running on PHP < 5.3.4, because a null byte injection is required.


[-] Solution:

Apply the vendor patch:http://www.vtiger.com/blogs/?p=1467


[-] Disclosure Timeline:

[13/01/2013] - Vendor notified
[06/02/2013] - Vendor asked feedback abouthttp://trac.vtiger.com/cgi-bin/trac.cgi/changeset/13848
[05/03/2013] - Feedback provided to the vendor
[26/03/2013] - Vendor patch released
[18/04/2013] - CVE number requested
[20/04/2013] - CVE number assigned
[01/08/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-3212 to these vulnerabilities.


[-] Credits:

Vulnerabilities discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-05



  By Date           By Thread  

Current thread:
  • [KIS-2013-05] vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities Egidio Romano (Aug 01)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault