{"uuid": "184c78a4-30d3-4539-a4fb-1b7b253ab521", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3214", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vtiger_soap_upload.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Egidio Romano\", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"vTiger CRM allows a user to bypass authentication when requesting SOAP services.\\n          In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP\\n          service. By combining both vulnerabilities an attacker can upload and execute PHP\\n          code. This module has been tested successfully on vTiger CRM v5.4.0 over Ubuntu\\n          10.04 and Windows 2003 SP2.\", \"disclosure_date\": \"2013-03-26\", \"fullname\": \"exploit/multi/http/vtiger_soap_upload\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/vtiger_soap_upload.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/vtiger_soap_upload\", \"references\": [\"CVE-2013-3214\", \"CVE-2013-3215\", \"OSVDB-95902\", \"OSVDB-95903\", \"BID-61558\", \"BID-61559\", \"EDB-27279\", \"URL-http://karmainsecurity.com/KIS-2013-07\", \"URL-http://karmainsecurity.com/KIS-2013-08\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"vTigerCRM v5.4.0\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:19.215831Z"}