← Advisories

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities

Medium

Advisory ID

ZSL-2011-5052

Release Date

26 October 2011

Vendor

vTiger - http://www.vtiger.com

Affected Version

5.2.1

CVE

N/A

Tested On

Microsoft Windows XP Professional SP3 (EN), Apache/2.0.52 (Win32), PHP/5.2.6, MySQL 5.0.51b-community-nt-log

Summary

vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support.

Description

vtiger CRM suffers from a XSS vulnerability when parsing user input to the '_operation' and 'search' parameters via GET method in '/modules/mobile/index.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Proof of Concept

vtiger_xss.txtTXT

Disclosure Timeline

28.07.2011Vulnerabilities discovered.

28.07.2011Initial contact with the vendor.

29.07.2011Vendor replies asking more details.

29.07.2011Sent details to vendor.

01.08.2011Requested status update from vendor.

02.08.2011Vendor investigates and confirms issues.

02.08.2011Asked vendor for patch release date.

04.08.2011No reply from vendor.

05.08.2011Asked vendor to specify patch release date.