CVE-2015-6000

HIGH 8.8CVE-2015-6000 · Published 06/02/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
vtiger crm vtiger	`≤ 6.3.0`	No fix yet

Description

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.

References

b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html · Exploit
securityfocus.com//archive/1/536563/100/0/threaded · Exploit
exploit-db.com/exploits/38345 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free