CVE-2013-5091 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 1.2% (pctl 67)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 1.19% — more likely to be exploited than 67% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-10-04 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| vtiger | vtiger crm |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | vTiger CRM 5.4.0 - 'index.php?onlyforuser' SQL Injection | 2013-09-20 |
References
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html
- http://osvdb.org/76138
- http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/
- http://www.exploit-db.com/exploits/28409
- https://www.htbridge.com/advisory/HTB23168
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html
- http://osvdb.org/76138
- http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/
- http://www.exploit-db.com/exploits/28409
- https://www.htbridge.com/advisory/HTB23168
→ the Explorer · watch your stack · NVD