CVE-2013-7225

Name of the Vulnerable Software and Affected Versions Fat Free CRM versions prior to 0.12.1

Description The issue allows remote authenticated users to execute arbitrary SQL commands via the homepage timeline feature or the activity feature. This is due to multiple SQL injection vulnerabilities in the app/controllers/home controller.rb file.

Recommendations For versions prior to 0.12.1, update to version 0.12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the homepage timeline and activity features until the update is applied.