CVE-2009-3248

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.0.4

Description A cross-site request forgery issue exists in the RSS module, allowing remote attackers to hijack Admin user authentication for modifying the news feed system. This is achieved via the rssurl parameter in a Save action to "index.php".

Recommendations For vtiger CRM version 5.0.4, consider restricting access to the RSS module until a fix is available, and avoid using the rssurl parameter in Save actions to "index.php" to minimize the risk of exploitation.