CVE-2005-3820
First published: Sat Nov 26 2005(Updated: )
Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimately execute arbitrary PHP code, via .. (dot dot) and null byte ("%00") sequences in the (1) module parameter and (2) action parameter in the Leads module, as also demonstrated by injecting PHP code into log messages and accessing the log file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vtiger CRM | <=4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.hardened-php.net/advisory_232005.105.html
- http://www.securityfocus.com/bid/15562
- http://www.securityfocus.com/bid/15569
- http://secunia.com/advisories/17693
- http://securitytracker.com/id?1015274
- http://securitytracker.com/id?1015271
- http://www.vupen.com/english/advisories/2005/2569
- http://marc.info/?l=full-disclosure&m=113290708121951&w=2
- http://www.securityfocus.com/archive/1/417730/30/0/threaded
- http://www.securityfocus.com/archive/1/417711/30/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3820?
CVE-2005-3820 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2005-3820?
To fix CVE-2005-3820, upgrade to a version of vTiger CRM later than 4.2 that does not include this vulnerability.
What vulnerability does CVE-2005-3820 exploit?
CVE-2005-3820 exploits directory traversal vulnerabilities allowing attackers to read or include arbitrary files.
Which versions of vTiger CRM are affected by CVE-2005-3820?
CVE-2005-3820 affects vTiger CRM version 4.2 and earlier.
What are the attack vectors for CVE-2005-3820?
The attack vectors for CVE-2005-3820 include manipulating the module and action parameters with dot dot and null byte sequences.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/event
- agent/first-publish-date
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/vtiger
- product/vtiger crm
- canonical/vtiger vtiger crm
- agent/tags
- agent/softwarecombine
- agent/source
- canonical/vtiger crm
- version/vtiger crm/4.2