Test ID:	1.3.6.1.4.1.25623.1.0.804055
Category:	Web application abuses
Title:	vTiger CRM Cross Site Scripting and SQL Injection Vulnerabilities
Summary:	vTiger CRM is prone to xss and sql injection vulnerabilities.
Description:	Summary: vTiger CRM is prone to xss and sql injection vulnerabilities. Vulnerability Insight: Flaw is due to the /index.php script not properly sanitizing user-supplied input to the 'onlyforuser' parameter and savetemplate.php, deletetask.php, edittask.php, savetask.php and saveworkflow.php scripts are not properly sanitizing the input passed via the 'return_url' parameter. Vulnerability Impact: Successful exploitation will allow attacker to execute arbitrary HTML or script code and inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. Affected Software/OS: vTiger CRM version 5.4.0 and prior. Solution: Update to version 6.0 or later. Alternatively apply the referenced security patch for 5.4.0. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-5091 Bugtraq: 20130918 SQL Injection in vtiger CRM (Google Search) http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html http://www.exploit-db.com/exploits/28409 https://www.htbridge.com/advisory/HTB23168 http://osvdb.org/76138
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.