CVE-2015-6000

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Vtiger	Vtiger CRM	6.3.0 and earlier

References

http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.htmlExploit, Third Party Advisory
http://www.securityfocus.com//archive/1/536563/100/0/threadedExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/38345/Exploit, Third Party Advisory, VDB Entry
http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.htmlExploit, Third Party Advisory
http://www.securityfocus.com//archive/1/536563/100/0/threadedExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/38345/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-60039.3Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows rem CVE-2015-60046.5Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1)CVE-2015-60056.9Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web scri CVE-2015-60067.5The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbit CVE-2015-60076.8Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the CVE-2015-60087.5install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPasswor CVE-2015-60097.5Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL CVE-2015-60104.3Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-0 CVE-2015-60115.0Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection atta CVE-2015-60125.8Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remot CVE-2015-601310.0Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local use CVE-2015-601410.0Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local use