CVE-2013-3213
Last modified
CVE-2013-3213 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php, or (3) emailaddress parameter in the SearchContactsByEmail method to soap/vtigerolservice.php; or remote authenticated users to execute arbitrary SQL commands via the (4) emailaddress parameter in the SearchContactsByEmail method to soap/thunderbirdplugin.php.. EPSS estimates a 3.21% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php, or (3) emailaddress parameter in the SearchContactsByEmail method to soap/vtigerolservice.php; or remote authenticated users to execute arbitrary SQL commands via the (4) emailaddress parameter in the SearchContactsByEmail method to soap/thunderbirdplugin.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vtiger | Vtiger Crm | 5.0.0 |
| Vtiger | Vtiger Crm | 5.0.1 |
| Vtiger | Vtiger Crm | 5.0.2 |
| Vtiger | Vtiger Crm | 5.0.3 |
| Vtiger | Vtiger Crm | 5.0.4 |
| Vtiger | Vtiger Crm | 5.1.0 |
| Vtiger | Vtiger Crm | 5.2.0 |
| Vtiger | Vtiger Crm | 5.2.1 |
| Vtiger | Vtiger Crm | 5.3.0 |
| Vtiger | Vtiger Crm | 5.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-3213?
How severe is CVE-2013-3213?
How do I fix CVE-2013-3213?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-3207Microsoft Internet Explorer 9 and 10 allows remote attackers…
- CVE-2013-3208Microsoft Internet Explorer 8 through 10 allows remote attac…
- CVE-2013-3209Microsoft Internet Explorer 9 and 10 allows remote attackers…
- CVE-2013-3210Opera before 12.15 does not properly block top-level domains…
- CVE-2013-3211Unspecified vulnerability in Opera before 12.15 has unknown …
- CVE-2013-3212vtiger CRM 5.4.0 and earlier contain local file-include vuln…8.1
- CVE-2013-3214vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vu…9.8
- CVE-2013-3215vtiger CRM 5.4.0 and earlier contain an Authentication Bypas…9.8
- CVE-2013-3219bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a …
- CVE-2013-3220bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8r…
- CVE-2013-3221The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3…
- CVE-2013-3222The vcc_recvmsg function in net/atm/common.c in the Linux ke…
Are you affected by CVE-2013-3213?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST