CVE-2013-3214

This Metasploit module exploits an arbitrary file upload vulnerability in vTiger CRM via SOAP services, allowing unauthenticated attackers to upload and execute PHP code. It combines authentication bypass (CVE-2013-3214) with file upload (CVE-2013-3215) to achieve RCE.

This exploit leverages a file upload vulnerability in vTiger CRM 5.4.0 to achieve remote code execution by uploading a malicious PHP file via a SOAP request. The payload executes arbitrary commands via a web shell.

This is a detailed technical writeup describing multiple vulnerabilities in vtiger CRM, including local file inclusion (LFI) and SQL injection (SQLi) flaws. It provides code snippets, root cause analysis, and patch references.

This Metasploit module exploits an authentication bypass and arbitrary file upload vulnerability in vTiger CRM via SOAP services. It uploads a PHP payload to achieve remote code execution.