CVE-2012-4867

Name of the Vulnerable Software and Affected Versions vtiger CRM version 5.1.0

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. (dot dot) in the module name parameter.

Recommendations For vtiger CRM version 5.1.0, consider restricting access to the sortfieldsjson.php file in the modules/com vtiger workflow directory until a patch is available. Avoid using the module name parameter with untrusted input to minimize the risk of exploitation.