CVE-2009-3249

vtiger CRM 5.0.4 - Path Traversal and Arbitrary File Execution via Module Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2009-3249. PoCs published by TecR0c, USH.

AI-analyzed exploit summary This exploit targets a Local File Inclusion (LFI) vulnerability in Vtiger CRM 5.0.4, allowing unauthenticated attackers to read arbitrary files on the server. The script includes functionality to detect the operating system and read sensitive files like logs or configuration files.

Description

Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable through modules/Campaigns/CampaignsAjax.php, modules/SalesOrder/SalesOrderAjax.php, modules/System/SystemAjax.php, modules/Products/ProductsAjax.php, modules/uploads/uploadsAjax.php, modules/Dashboard/DashboardAjax.php, modules/Potentials/PotentialsAjax.php, modules/Notes/NotesAjax.php, modules/Faq/FaqAjax.php, modules/Quotes/QuotesAjax.php, modules/Utilities/UtilitiesAjax.php, modules/Calendar/ActivityAjax.php, modules/Calendar/CalendarAjax.php, modules/PurchaseOrder/PurchaseOrderAjax.php, modules/HelpDesk/HelpDeskAjax.php, modules/Invoice/InvoiceAjax.php, modules/Accounts/AccountsAjax.php, modules/Reports/ReportsAjax.php, modules/Contacts/ContactsAjax.php, and modules/Portal/PortalAjax.php; and allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the step parameter in an Import action to the (4) Accounts, (5) Contacts, (6) HelpDesk, (7) Leads, (8) Potentials, (9) Products, or (10) Vendors module, reachable through index.php and related to modules/Import/index.php and multiple Import.php files.

Exploits (2)

exploitdb WORKING POC VERIFIED
by TecR0c · pythonwebappsphp
https://www.exploit-db.com/exploits/16280

This exploit targets a Local File Inclusion (LFI) vulnerability in Vtiger CRM 5.0.4, allowing unauthenticated attackers to read arbitrary files on the server. The script includes functionality to detect the operating system and read sensitive files like logs or configuration files.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Vtiger CRM 5.0.4
No auth needed
Prerequisites: PHP.ini with gpc_magic_quotes = Off · Access to the vulnerable graph.php endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by USH · textwebappsphp
https://www.exploit-db.com/exploits/9450

This is a detailed technical advisory describing multiple vulnerabilities in Vtiger CRM 5.0.4, including RCE (Windows-specific), CSRF, LFI, and XSS. It provides root cause analysis, exploitation methodologies, and specific code paths but does not include functional exploit code.

Classification
Writeup 100%
Attack Type
Rce | Lfi | Csrf | Xss
Complexity
Moderate
Reliability
Theoretical
Target: Vtiger CRM 5.0.4
Auth required
Prerequisites: Valid user account for RCE and some LFI exploits · Windows OS for RCE via filename manipulation
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (9)

Core 9
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8118
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/57239
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9450
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=125060676515670&w=2
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36062
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36309
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2319

Scores

EPSS 0.0959
EPSS Percentile 94.9%

Details

CWE
CWE-22
Status published
Products (1)
vtiger/vtiger_crm 5.0.4
Published Sep 18, 2009
Tracked Since Feb 18, 2026