CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
vtigervtiger_crm
7.5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php
https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43
https://github.com/jselliott/CVE-2023-46304
https://www.vtiger.com/
https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php
https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43
https://github.com/jselliott/CVE-2023-46304
https://www.vtiger.com/