CVE-2005-3823

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 4.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval() function.

Recommendations For versions 4.2 and earlier, consider restricting access to the Users module until a fix is available. As a temporary workaround, avoid using the templatename parameter in the affected module to minimize the risk of exploitation.