Security Advisory

CVE-2009-3250

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2009-09-18 20:00:00

Last updated 2024-08-07 06:22:24

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.

← Browse all CVEs View on cve.org ↗