CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. It is related to actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.

• CWE-434

• http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375Patch, Vendor Advisory
• http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.htmlMailing List, Patch, Vendor Advisory
• https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46065Exploit, Third Party Advisory, VDB Entry
• http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375Patch, Vendor Advisory
• http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.htmlMailing List, Patch, Vendor Advisory
• https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46065Exploit, Third Party Advisory, VDB Entry

Published

Jan 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5002Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5003Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5005An issue was discovered in Foxit Reader and PhantomPDF befor…
• CVE-2019-5006An issue was discovered in Foxit Reader and PhantomPDF befor…
• CVE-2019-5007An issue was discovered in Foxit Reader and PhantomPDF befor…
• CVE-2019-5008hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL po…
• CVE-2019-5010An exploitable denial-of-service vulnerability exists in the…7.5
• CVE-2019-5011An exploitable privilege escalation vulnerability exists in …5.5
• CVE-2019-5012An exploitable privilege escalation vulnerability exists in …7.8
• CVE-2019-5013An exploitable privilege escalation vulnerability exists in …7.8
• CVE-2019-5014An exploitable improper access control vulnerability exists …6.5
• CVE-2019-5015A local privilege escalation vulnerability exists in the Mac…7.8