CVE-2010-3909

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-11-26 · updated 2026-06-16
Weakness: CWE-94

Description

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.

Affected products

Vtiger CRM: through 5.2.0; 1.0, 2.0, 2.0.1, 2.1, 3, 3.0 (+16)

References

http://secunia.com/advisories/42246
http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
http://www.securityfocus.com/archive/1/514846/100/0/threaded
http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
http://secunia.com/advisories/42246
http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
http://www.securityfocus.com/archive/1/514846/100/0/threaded
http://www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt

Get alerted when CVE-2010-3909 or the next vulnerability affects your stack