<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body >Dear Kim Haverblad,<br><br>My sincere apologies for posting reply to another thread. <br><br>It is a mistake on my part. <br><br>Regards,<br>Gopal<br>---
<br>S.S.G.Gopal
<br>skype: sripadag
<br>ph: +1 877 788 4437
<br>blog: http://gopal.vtiger.com<br><br><br><br><br>---- On Mon, 04 Sep 2006 <b>Kim Haverblad <kim@haverblad.se></b> wrote ---- <br><br><blockquote style="border-left: 1px solid rgb(160, 154, 255); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
New vulnerability has been posted by Ivan Markovic regarding Cross Site<br>Scripting, Security Bypass and Remote Command Execution.<br><br>Original advisory:<br><a href="http://www.security-net.biz/adv/D3906a.txt">http://www.security-net.biz/adv/D3906a.txt</a><br><br>Secunia advisory:<br><a href="http://secunia.com/advisories/21728/">http://secunia.com/advisories/21728/</a><br><br>Description:<br>Ivan Markovic has discovered some vulnerabilities in vtiger CRM, which<br>can be exploited by malicious people to conduct script insertion attacks<br>and bypass certain security restrictions.<br><br>1) Input passed to the "description" field in various modules when e.g.<br>creating a contact and the "solution" field when an administrator<br>modifies the solution in the HelpDesk modules isn't properly sanitised<br>before being used. This can be exploited to inject arbitrary HTML and<br>script code, which will be executed in a user's browser session in<br>context of an affected site when the malicious user data is viewed.<br><br>2) An error in the access control verification can be exploited by a<br>normal user to access administrative modules (e.g. the settings section)<br>by accessing certain URLs directly.<br><br>The vulnerabilities have been confirmed in version 4.2.4. Other versions<br>may also be affected.<br><br>Solution:<br>Edit the source code to ensure that input is properly sanitised and that<br>access to administrative modules are properly checked.<br><br>Use another product.<br>_______________________________________________<br>Get started with creating presentations online - <a href="http://zohoshow.com?vt">http://zohoshow.com?vt</a> <br>
</div>
</blockquote></body></html>