CVE-2023-46304

Deeper analysis

CVE-2023-46304 affects Vtiger CRM version 7.5.0 in the file modules/Users/models/Module.php. The flaw stems from an unprotected endpoint that permits writing arbitrary PHP code into the config.inc.php configuration file, which is loaded and executed on every page request. The issue is tracked under CWE-74 and carries a CVSS 3.1 score of 8.1.

A remote authenticated attacker can exploit the endpoint to inject and persist PHP payloads without needing additional user interaction or special network positioning beyond standard HTTP access. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the web application on subsequent page loads, potentially leading to full system compromise.

Public references include a vendor commit that addresses the unprotected write path and a proof-of-concept repository demonstrating the injection technique. The associated EPSS score has remained flat at 0.2076 since disclosure, indicating no observed surge in exploitation interest.