CyberRota Analysis
AI-GeneratedVtiger CRM versions prior to 8.4.0 are vulnerable to an authenticated file upload flaw that enables low-privileged users to perform remote code execution by uploading malicious .phar files through the Documents module. The vulnerability arises from a bypass of the extension denylist and misconfigurations in Apache 2.4 that permit direct execution of the uploaded PHP code. Organizations using affected versions of Vtiger CRM should prioritize patching this vulnerability to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.