CVE-2016-1713

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.

• CWE-434

• http://b.fl7.de/2016/01/vtiger-crm-6.4-auth-rce.htmlExploit, Technical Description, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/01/12/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/01/12/7Mailing List
• https://www.exploit-db.com/exploits/44379/
• http://b.fl7.de/2016/01/vtiger-crm-6.4-auth-rce.htmlExploit, Technical Description, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/01/12/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/01/12/7Mailing List
• https://www.exploit-db.com/exploits/44379/

Published

Apr 14, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1707ios/web/web_state/ui/crw_web_controller.mm in Google Chrome …
• CVE-2016-1708The Chrome Web Store inline-installation implementation in t…
• CVE-2016-1709Heap-based buffer overflow in the ByteArray::Get method in d…
• CVE-2016-1710The ChromeClientImpl::createWindow method in WebKit/Source/w…
• CVE-2016-1711WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used …
• CVE-2016-1712Palo Alto Networks PAN-OS before 5.0.19, 5.1.x before 5.1.12…
• CVE-2016-1714The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvr…
• CVE-2016-1715The swin.sys kernel driver in McAfee Application Control (MA…
• CVE-2016-1716AppleGraphicsPowerManagement in Apple OS X before 10.11.3 al…
• CVE-2016-1717The Disk Images component in Apple iOS before 9.2.1, OS X be…
• CVE-2016-1718The IOAcceleratorFamily2 interface in IOAcceleratorFamily in…
• CVE-2016-1719The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 1…