CVE-2005-3820

CVE-2005-3820 describes multiple directory traversal vulnerabilities in vTiger CRM 4.2 and earlier. Attackers can exploit these flaws by manipulating the 'module' and 'action' parameters in index.php, specifically within the Leads module, using dot-dot and null byte sequences. This allows for reading or including arbitrary files, and ultimately executing arbitrary PHP code, including through log file injection. The vulnerability has a CVSS score of 6.4, indicating a medium severity with low attack complexity and no authentication required, potentially leading to partial confidentiality and integrity impacts. There is no evidence of active exploitation, no known exploit code in common repositories like Metasploit or ExploitDB, and minimal community discussion or media coverage.