CVE-2009-3248

Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.

• CWE-352

• http://marc.info/?l=bugtraq&m=125060676515670&w=2Exploit
• http://secunia.com/advisories/36309Vendor Advisory
• http://www.exploit-db.com/exploits/9450
• http://www.osvdb.org/57238Exploit
• http://www.securityfocus.com/bid/36062Exploit
• http://www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/Exploit
• http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txtExploit
• http://www.vupen.com/english/advisories/2009/2319Vendor Advisory
• http://marc.info/?l=bugtraq&m=125060676515670&w=2Exploit
• http://secunia.com/advisories/36309Vendor Advisory
• http://www.exploit-db.com/exploits/9450
• http://www.osvdb.org/57238Exploit
• http://www.securityfocus.com/bid/36062Exploit
• http://www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/Exploit
• http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txtExploit
• http://www.vupen.com/english/advisories/2009/2319Vendor Advisory

Published

Sep 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3242Unspecified vulnerability in packet.c in the GSM A RR dissec…
• CVE-2009-3243Unspecified vulnerability in the TLS dissector in Wireshark …
• CVE-2009-3244Heap-based buffer overflow in the SwDir.dll ActiveX control …
• CVE-2009-3245OpenSSL before 0.9.8m does not check for a NULL return value…
• CVE-2009-3246SQL injection vulnerability in spnews.php in MyBuxScript PTC…
• CVE-2009-3247Cross-site scripting (XSS) vulnerability in the Activities m…
• CVE-2009-3249Multiple directory traversal vulnerabilities in vtiger CRM 5…
• CVE-2009-3250The saveForwardAttachments procedure in the Compose Mail fun…
• CVE-2009-3251include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 a…
• CVE-2009-3252Multiple SQL injection vulnerabilities in news.php in Rock B…
• CVE-2009-3253Stack-based buffer overflow in TriceraSoft Swift Ultralite 1…
• CVE-2009-3254Multiple stack-based buffer overflows in Ultimate Player 1.5…