CVE-2013-3214
CRITICALvtiger CRM < 5.4.0 - PHP Code Injection via vtigerolservice.php
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2013-3214.
PoCs published by Metasploit, shadofren, Egidio Romano, juan vazquez, including Metasploit module exploits/multi/http/vtiger_soap_upload.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in vTiger CRM via SOAP services, allowing unauthenticated attackers to upload and execute PHP code. It combines authentication bypass (CVE-2013-3214) with file upload (CVE-2013-3215) to achieve RCE.
Description
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
Exploits (4)
This Metasploit module exploits an arbitrary file upload vulnerability in vTiger CRM via SOAP services, allowing unauthenticated attackers to upload and execute PHP code. It combines authentication bypass (CVE-2013-3214) with file upload (CVE-2013-3215) to achieve RCE.
This exploit leverages a file upload vulnerability in vTiger CRM 5.4.0 to achieve remote code execution by uploading a malicious PHP file via a SOAP request. The payload executes arbitrary commands via a web shell.
This is a detailed technical writeup describing multiple vulnerabilities in vtiger CRM, including local file inclusion (LFI) and SQL injection (SQLi) flaws. It provides code snippets, root cause analysis, and patch references.
This Metasploit module exploits an authentication bypass and arbitrary file upload vulnerability in vTiger CRM via SOAP services. It uploads a PHP payload to achieve remote code execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H