CVE-2013-5091

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.htmlThird Party Advisory
http://osvdb.org/76138Broken Link
http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/Patch, Third Party Advisory
http://www.exploit-db.com/exploits/28409Exploit, Third Party Advisory
https://www.htbridge.com/advisory/HTB23168Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.htmlThird Party Advisory
http://osvdb.org/76138Broken Link
http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/Patch, Third Party Advisory
http://www.exploit-db.com/exploits/28409Exploit, Third Party Advisory
https://www.htbridge.com/advisory/HTB23168Third Party Advisory

Timeline

Published: Oct 4, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-50924.3Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitra CVE-2013-50936.8The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, whi CVE-2013-50944.3Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inject arbitrary web sc CVE-2013-50954.3Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance CVE-2013-50964.0Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access co CVE-2013-50974.0Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of CVE-2013-50984.3Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attack CVE-2013-50992.6Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject ar CVE-2013-51004.3Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007) extension before 0.10.2 for TYPO3 allows remote attacker CVE-2013-51068.8A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.CVE-2013-51075.0Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the R CVE-2013-51084.3Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbit