{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10060","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10060/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10060/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10060/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10060","id":324532010,"node_id":"MDExOlB1bGxSZXF1ZXN0MTg5MTE5Mjk0","number":10060,"title":"vTiger CRM v6.3.0 (CVE:2015-6000,CVE:2016-1713)","user":{"login":"touhidshaikh","id":26184236,"node_id":"MDQ6VXNlcjI2MTg0MjM2","avatar_url":"https://avatars3.githubusercontent.com/u/26184236?v=4","gravatar_id":"","url":"https://api.github.com/users/touhidshaikh","html_url":"https://github.com/touhidshaikh","followers_url":"https://api.github.com/users/touhidshaikh/followers","following_url":"https://api.github.com/users/touhidshaikh/following{/other_user}","gists_url":"https://api.github.com/users/touhidshaikh/gists{/gist_id}","starred_url":"https://api.github.com/users/touhidshaikh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/touhidshaikh/subscriptions","organizations_url":"https://api.github.com/users/touhidshaikh/orgs","repos_url":"https://api.github.com/users/touhidshaikh/repos","events_url":"https://api.github.com/users/touhidshaikh/events{/privacy}","received_events_url":"https://api.github.com/users/touhidshaikh/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"node_id":"MDU6TGFiZWwxMDM0MzYyMTU=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"jrobles-r7","id":23102036,"node_id":"MDQ6VXNlcjIzMTAyMDM2","avatar_url":"https://avatars3.githubusercontent.com/u/23102036?v=4","gravatar_id":"","url":"https://api.github.com/users/jrobles-r7","html_url":"https://github.com/jrobles-r7","followers_url":"https://api.github.com/users/jrobles-r7/followers","following_url":"https://api.github.com/users/jrobles-r7/following{/other_user}","gists_url":"https://api.github.com/users/jrobles-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jrobles-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrobles-r7/subscriptions","organizations_url":"https://api.github.com/users/jrobles-r7/orgs","repos_url":"https://api.github.com/users/jrobles-r7/repos","events_url":"https://api.github.com/users/jrobles-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jrobles-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"jrobles-r7","id":23102036,"node_id":"MDQ6VXNlcjIzMTAyMDM2","avatar_url":"https://avatars3.githubusercontent.com/u/23102036?v=4","gravatar_id":"","url":"https://api.github.com/users/jrobles-r7","html_url":"https://github.com/jrobles-r7","followers_url":"https://api.github.com/users/jrobles-r7/followers","following_url":"https://api.github.com/users/jrobles-r7/following{/other_user}","gists_url":"https://api.github.com/users/jrobles-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jrobles-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrobles-r7/subscriptions","organizations_url":"https://api.github.com/users/jrobles-r7/orgs","repos_url":"https://api.github.com/users/jrobles-r7/repos","events_url":"https://api.github.com/users/jrobles-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jrobles-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-05-18T19:50:39Z","updated_at":"2018-07-30T17:36:13Z","closed_at":"2018-07-30T17:33:19Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10060","html_url":"https://github.com/rapid7/metasploit-framework/pull/10060","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10060.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10060.patch"},"body":"## Description\r\nVtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file.\r\nMore :[Visit]( https://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html)\r\n\r\nCVE : CVE-2015-6000\r\n\r\n## Vulnerable Application \r\n[VTiger 6.3.0 on Exploit-db](https://www.exploit-db.com/apps/d5d940a28d83d915d20dbfeb33eb5bef-vtigercrm6.3.0.tar.gz)\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/408947285","html_url":"https://github.com/rapid7/metasploit-framework/pull/10060#issuecomment-408947285","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10060","id":408947285,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODk0NzI4NQ==","user":{"login":"jrobles-r7","id":23102036,"node_id":"MDQ6VXNlcjIzMTAyMDM2","avatar_url":"https://avatars3.githubusercontent.com/u/23102036?v=4","gravatar_id":"","url":"https://api.github.com/users/jrobles-r7","html_url":"https://github.com/jrobles-r7","followers_url":"https://api.github.com/users/jrobles-r7/followers","following_url":"https://api.github.com/users/jrobles-r7/following{/other_user}","gists_url":"https://api.github.com/users/jrobles-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jrobles-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrobles-r7/subscriptions","organizations_url":"https://api.github.com/users/jrobles-r7/orgs","repos_url":"https://api.github.com/users/jrobles-r7/repos","events_url":"https://api.github.com/users/jrobles-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jrobles-r7/received_events","type":"User","site_admin":false},"created_at":"2018-07-30T17:36:13Z","updated_at":"2018-07-30T17:36:13Z","author_association":"CONTRIBUTOR","body":"## Release Notes\r\n\r\nThe exploit/multi/http/vtiger_logo_upload_exec module has been added to framework. It allows authenticated remote code execution through an unrestricted file upload in Vtiger CRM v6.3.0."}}
{"actor":{"display_login":"jrobles-r7"}}