CVE-2013-5091

vtiger CRM < 5.4.0 - Authenticated SQL Injection via onlyforuser Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-5091. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The advisory describes a SQL injection vulnerability in vtiger CRM 5.4.0, where the 'onlyforuser' parameter in the '/index.php' script is insufficiently validated, allowing authenticated users to execute arbitrary SQL commands. The provided URL demonstrates the exploitation by injecting a UNION-based SQL query to retrieve the MySQL server version.

Description

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.

Exploits (1)

exploitdb WRITEUP
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/28409

The advisory describes a SQL injection vulnerability in vtiger CRM 5.4.0, where the 'onlyforuser' parameter in the '/index.php' script is insufficiently validated, allowing authenticated users to execute arbitrary SQL commands. The provided URL demonstrates the exploitation by injecting a UNION-based SQL query to retrieve the MySQL server version.

Classification
Writeup 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: vtiger CRM 5.4.0 and prior
Auth required
Prerequisites: Authenticated user access · Registration enabled (disabled by default)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html
Third Party Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23168
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/76138
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/28409

Scores

EPSS 0.0124
EPSS Percentile 65.2%

Details

CWE
CWE-89
Status published
Products (20)
vtiger/vtiger_crm 1.0
vtiger/vtiger_crm 2.0
vtiger/vtiger_crm 2.0.1
vtiger/vtiger_crm 2.1
vtiger/vtiger_crm 3.0 (2 CPE variants)
vtiger/vtiger_crm 3.2
vtiger/vtiger_crm 4 (4 CPE variants)
vtiger/vtiger_crm 4.0
vtiger/vtiger_crm 4.0.1
vtiger/vtiger_crm 4.2 (3 CPE variants)
... and 10 more
Published Oct 04, 2013
Tracked Since Feb 18, 2026