CVE-2014-2268

Published: Nov 16, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.

Affected (30)

Products: Vtiger: Vtiger Crm

Vtiger

1 product

Vtiger Crm

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Vtiger Vtiger Crm	Version 1.0
Vtiger Vtiger Crm	Version 2.0.1
Vtiger Vtiger Crm	Version 2.0
Vtiger Vtiger Crm	Version 2.1
Vtiger Vtiger Crm	Version 3.0
Vtiger Vtiger Crm	Version 3.0 beta
Vtiger Vtiger Crm	Version 3.2
Vtiger Vtiger Crm	Version 4.0.1
Vtiger Vtiger Crm	Version 4.0
Vtiger Vtiger Crm	Version 4.2.4
Vtiger Vtiger Crm	Version 4.2
Vtiger Vtiger Crm	Version 4
Vtiger Vtiger Crm	Version 4 beta
Vtiger Vtiger Crm	Version 4 rc1
Vtiger Vtiger Crm	Version 5.0.0
Vtiger Vtiger Crm	Version 5.0.1
Vtiger Vtiger Crm	Version 5.0.2
Vtiger Vtiger Crm	Version 5.0.3
Vtiger Vtiger Crm	Version 5.0.4
Vtiger Vtiger Crm	Version 5.0.4 rc
Vtiger Vtiger Crm	Version 5.1.0
Vtiger Vtiger Crm	Version 5.1.0 rc
Vtiger Vtiger Crm	Version 5.2.0
Vtiger Vtiger Crm	Version 5.2.1
Vtiger Vtiger Crm	Version 5.3.0
Vtiger Vtiger Crm	Version 5.4.0
Vtiger Vtiger Crm	Version 6.0.0
Vtiger Vtiger Crm	Version 6.0.0 beta
Vtiger Vtiger Crm	Version 6.0.0 rc
Vtiger Vtiger Crm	Version 6.0.0 sp1