CVE-2009-3249

Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable through modules/Campaigns/CampaignsAjax.php, modules/SalesOrder/SalesOrderAjax.php, modules/System/SystemAjax.php, modules/Products/ProductsAjax.php, modules/uploads/uploadsAjax.php, modules/Dashboard/DashboardAjax.php, modules/Potentials/PotentialsAjax.php, modules/Notes/NotesAjax.php, modules/Faq/FaqAjax.php, modules/Quotes/QuotesAjax.php, modules/Utilities/UtilitiesAjax.php, modules/Calendar/ActivityAjax.php, modules/Calendar/CalendarAjax.php, modules/PurchaseOrder/PurchaseOrderAjax.php, modules/HelpDesk/HelpDeskAjax.php, modules/Invoice/InvoiceAjax.php, modules/Accounts/AccountsAjax.php, modules/Reports/ReportsAjax.php, modules/Contacts/ContactsAjax.php, and modules/Portal/PortalAjax.php; and allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the step parameter in an Import action to the (4) Accounts, (5) Contacts, (6) HelpDesk, (7) Leads, (8) Potentials, (9) Products, or (10) Vendors module, reachable through index.php and related to modules/Import/index.php and multiple Import.php files.

• CWE-22

• http://marc.info/?l=bugtraq&m=125060676515670&w=2
• http://secunia.com/advisories/36309Vendor Advisory
• http://securityreason.com/securityalert/8118
• http://www.exploit-db.com/exploits/9450
• http://www.osvdb.org/57239Exploit
• http://www.securityfocus.com/bid/36062Exploit
• http://www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/Exploit
• http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txtExploit
• http://www.vupen.com/english/advisories/2009/2319Vendor Advisory
• http://marc.info/?l=bugtraq&m=125060676515670&w=2
• http://secunia.com/advisories/36309Vendor Advisory
• http://securityreason.com/securityalert/8118
• http://www.exploit-db.com/exploits/9450
• http://www.osvdb.org/57239Exploit
• http://www.securityfocus.com/bid/36062Exploit
• http://www.ush.it/2009/08/18/vtiger-crm-504-multiple-vulnerabilities/Exploit
• http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txtExploit
• http://www.vupen.com/english/advisories/2009/2319Vendor Advisory

Published

Sep 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3243Unspecified vulnerability in the TLS dissector in Wireshark …
• CVE-2009-3244Heap-based buffer overflow in the SwDir.dll ActiveX control …
• CVE-2009-3245OpenSSL before 0.9.8m does not check for a NULL return value…
• CVE-2009-3246SQL injection vulnerability in spnews.php in MyBuxScript PTC…
• CVE-2009-3247Cross-site scripting (XSS) vulnerability in the Activities m…
• CVE-2009-3248Cross-site request forgery (CSRF) vulnerability in the RSS m…
• CVE-2009-3250The saveForwardAttachments procedure in the Compose Mail fun…
• CVE-2009-3251include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 a…
• CVE-2009-3252Multiple SQL injection vulnerabilities in news.php in Rock B…
• CVE-2009-3253Stack-based buffer overflow in TriceraSoft Swift Ultralite 1…
• CVE-2009-3254Multiple stack-based buffer overflows in Ultimate Player 1.5…
• CVE-2009-3255SQL injection vulnerability in RASH Quote Management System …