CVE-2013-3214: vtiger CRM PHP code injection in vtigerolservice.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, public exploit code, and a very high EPSS score makes this an urgent patch target.

What it is

vtiger CRM 5.4.0 and earlier contain a PHP code injection flaw in the file vtigerolservice.php. Because the injected code runs in the application's PHP context, an unauthenticated remote attacker can execute arbitrary code on the server. The record gives no further detail on the vulnerable parameter or injection mechanism.

Impact

An attacker gains remote code execution with the privileges of the web server, allowing full compromise of the CRM host and any data it holds. No specific post-exploitation behavior is described in the record.

Attack surface

Reachable over the network via the vtigerolservice.php endpoint, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not identify the exact request parameter or path used for injection.

Exploitation

Not listed in CISA KEV, but an Exploit-DB entry (30787) is referenced, indicating public exploit code exists; EPSS is very high at 0.845 (99.7th percentile), suggesting active exploitation likelihood.

What to do

• Upgrade vtiger CRM to a version later than 5.4.0, or apply the vendor fix for vtigerolservice.php; the record does not name a specific patched version.
• If upgrade is not possible, remove or block external access to vtigerolservice.php and restrict it to trusted internal hosts.
• Deploy a WAF rule to detect and block PHP code injection patterns targeting vtigerolservice.php.
• Run the CRM under a least-privilege web server account and disable dangerous PHP functions where feasible.
• Isolate the CRM server on a segmented network so a compromise cannot pivot to other systems.

Detection

• Monitor web logs for requests to vtigerolservice.php with suspicious parameters containing PHP code or function calls.
• Alert on unexpected child processes spawned by the web server (for example shell or scripting interpreters).
• Watch for new or modified PHP files in the vtiger web root, which may indicate injected webshells.
• Review outbound connections from the CRM host for signs of command-and-control or data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.