CVE-2023-46304

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46304
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php Product
https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 Patch
https://github.com/jselliott/CVE-2023-46304 Exploit
https://www.vtiger.com/ Product
https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php Product
https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 Patch
https://github.com/jselliott/CVE-2023-46304 Exploit
https://www.vtiger.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:vtiger:vtiger_crm:7.5.0:*:*:*:*:*:*:*
History

22 Apr 2025, 17:53

Type Values Removed Values Added
CPE cpe:2.3:a:vtiger:vtiger_crm:7.5.0:*:*:*:*:*:*:*
First Time Vtiger
Vtiger vtiger Crm
References () https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php - () https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php - Product
References () https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 - () https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 - Patch
References () https://github.com/jselliott/CVE-2023-46304 - () https://github.com/jselliott/CVE-2023-46304 - Exploit
References () https://www.vtiger.com/ - () https://www.vtiger.com/ - Product

21 Nov 2024, 08:28

Type Values Removed Values Added
References () https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php - () https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php -
References () https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 - () https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43 -
References () https://github.com/jselliott/CVE-2023-46304 - () https://github.com/jselliott/CVE-2023-46304 -
References () https://www.vtiger.com/ - () https://www.vtiger.com/ -

03 Jul 2024, 01:42

Type Values Removed Values Added
Summary
  • (es) module/Users/models/Module.php en Vtiger CRM 7.5.0 permite que un atacante remoto autenticado ejecute código PHP arbitrario porque un endpoint desprotegido le permite escribir este código en el archivo config.inc.php (ejecutado en cada carga de página) .
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-74

30 Apr 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-30 13:15

Updated : 2025-04-22 17:53

NVD link : CVE-2023-46304

Mitre link : CVE-2023-46304

CVE.ORG link : CVE-2023-46304

JSON object : View

Products Affected

vtiger

  • vtiger_crm
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')