CVE-2014-2268
N/A
Published: November 16, 2014 at 01:00 AM UTC
Updated: June 17, 2026 at 12:06 AM UTC
1 product affected across 1 vendorVtiger CRM
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 31%
Description
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (4)
Mailing Listx_refsource_MLISTVendor Advisory
Source: [email protected]
http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.htmlExploitx_refsource_EXPLOIT-DBThird Party Advisory
Source: [email protected]
http://www.exploit-db.com/exploits/32794VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/66757x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.htmlQuick Info
StatusMODIFIED
CWE
CWE-264
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card