<p dir="ltr">It is very troubling.</p>
<p dir="ltr">Don't know that will be the case though.</p>
<p dir="ltr">Haven't checked trac yet for it myself</p>
<div class="gmail_quote">On Jul 23, 2013 12:42 PM, "Juan Pablo Botero" <<a href="mailto:juanpabloboterolopez@gmail.com">juanpabloboterolopez@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">It seems this will persist in the new version of vtiger<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/7/18 Juan Pablo Jaramillo Pineda <span dir="ltr"><<a href="mailto:juanpablojp1@gmail.com" target="_blank">juanpablojp1@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi everyone,<br><br>Although it has been fixed in the GUI, the vulnerability still exist. If I generate the next payload (e.g. OWASP ZAP) on a HTTP POST message I'll become Admin:<br>
<br>value=on&field=is_admin&record=5&module=Users&action=SaveAjax (record=5 is mi user id)<br>
<br>Even worse, I could eliminate the admin privileges to the user Admin changing the payload as follows (record=1 and value=off):<br><br>value=off&field=is_admin&record=1&module=Users&action=SaveAjax<br>
<br>
In theory, I could change any data (field and value) on any user (record) unless the password.<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/6/6 Appu <span dir="ltr"><<a href="mailto:apparao@vtiger.com" target="_blank">apparao@vtiger.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><font color="#000000"><font face="verdana,sans-serif">Danny,</font></font><div><font color="#000000"><font face="verdana,sans-serif"><br>
</font></font></div><div><font color="#000000"><font face="verdana,sans-serif">Thanks for reporting this issue. I have created a trac ticket.</font></font></div>
<div><font color="#000000"><font face="verdana,sans-serif"><br></font></font></div><div><a href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7701" target="_blank">http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7701</a></div>
<div><br>
</div>
<div><div><div dir="ltr"><span style="color:rgb(102,102,102);font-family:verdana,sans-serif"><span style="color:rgb(0,0,0)"></span><span style="color:rgb(0,0,0)"></span><font color="#000000"><br>
<br></font><span style="font-family:verdana,sans-serif">Regards,</span></span><br style="font-family:verdana,sans-serif"><font><span style="font-family:verdana,sans-serif">Apparao G</span></font><br>
<br style="font-family:verdana,sans-serif"><b style="color:rgb(51,51,51)"><font style="font-family:verdana,sans-serif;color:rgb(102,102,102)"><img height="24" width="96"><font size="1">TEAM</font></font></b><br>
<br><b style="font-family:verdana,sans-serif">Connect with us on: </b><a style="font-family:verdana,sans-serif" href="http://vtiger.com/" target="_blank">Website</a><b style="font-family:verdana,sans-serif"> </b><b style="font-family:verdana,sans-serif">I</b><span style="font-family:verdana,sans-serif"> </span><a style="font-family:verdana,sans-serif" href="http://twitter.com/#%21/vtigercrm" target="_blank">Twitter</a><span style="font-family:verdana,sans-serif"> </span><b style="font-family:verdana,sans-serif">I</b><span style="font-family:verdana,sans-serif"> </span><a style="font-family:verdana,sans-serif" href="http://www.facebook.com/pages/vtiger/226866697333578?sk=wall" target="_blank">Facebook</a><span style="font-family:verdana,sans-serif"> </span><b style="font-family:verdana,sans-serif">I</b><span style="font-family:verdana,sans-serif"> </span><a style="font-family:verdana,sans-serif" href="http://blog.vtiger.com/" target="_blank">Blog</a><b style="font-family:verdana,sans-serif"> I</b><span style="font-family:verdana,sans-serif"> </span><a style="font-family:verdana,sans-serif" href="http://wiki.vtiger.com/index.php/Main_Page" target="_blank">Wiki</a><span style="font-family:verdana,sans-serif"> </span><b style="font-family:verdana,sans-serif">I </b><a style="font-family:verdana,sans-serif" href="http://forums.vtiger.com/" target="_blank">Forums </a><span style="font-family:verdana,sans-serif"> </span><br>
<span style="color:rgb(102,102,102)"><span></span><b><span></span></b></span></div></div>
<br><br><div class="gmail_quote"><div><div>On Thu, Jun 6, 2013 at 2:15 PM, Daniel Thompson <span dir="ltr"><<a href="mailto:developingdanny@gmail.com" target="_blank">developingdanny@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
<div dir="ltr">Hi,<div><br></div><div>Any user who is not an admin can change themselves to admin.</div><div><br></div><div>This can be done by my preferences, detail mode, click on the no and check the box.</div>
<div><br></div><div>Regards</div><div><br></div><div>Danny</div></div>
<br></div></div>_______________________________________________<br>
<a href="http://www.vtiger.com/" target="_blank">http://www.vtiger.com/</a><br></blockquote></div><br></div></div>
<br></div></div>_______________________________________________<br>
<a href="http://www.vtiger.com/" target="_blank">http://www.vtiger.com/</a><span><font color="#888888"><br></font></span></blockquote></div><span><font color="#888888"><br><br clear="all"><br>
-- <br>Juan Pablo Jaramillo Pineda<br>Estudiante Ingeniería en Sistemas y Computación<br>Universidad de Caldas<br>
<a href="http://verlaciudad.com" target="_blank">http://verlaciudad.com</a>
</font></span></div>
<br>_______________________________________________<br>
<a href="http://www.vtiger.com/" target="_blank">http://www.vtiger.com/</a><br></blockquote></div><br><br clear="all"><br>-- <br>Cordialmente:<br>Juan Pablo Botero<br>Administrador de Sistemas informáticos<br>Fedora Ambassador for Colombia<div>
<a href="http://www.jpilldev.net" target="_blank">http://www.jpilldev.net</a><br></div>
</div>
<br>_______________________________________________<br>
<a href="http://www.vtiger.com/" target="_blank">http://www.vtiger.com/</a><br></blockquote></div>