modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).
CVSS
No CVSS.
References
Configurations
History
22 Apr 2025, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vtiger
Vtiger vtiger Crm |
|
| CPE | cpe:2.3:a:vtiger:vtiger_crm:7.5.0:*:*:*:*:*:*:* | |
| References | () https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php - Product | |
| References | () https://www.vtiger.com/ - Product | |
| References | () https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 - Patch | |
| References | () https://github.com/jselliott/CVE-2023-46304 - Exploit |
30 Apr 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-30 13:15
Updated : 2025-04-22 17:53
NVD link : CVE-2023-46304
Mitre link : CVE-2023-46304
JSON object : View
Products Affected
vtiger
- vtiger_crm
CWE
No CWE.