Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php reachable through modules/Campaigns/CampaignsAjax.php modules/SalesOrder/SalesOrderAjax.php modules/System/SystemAjax.php modules/Products/ProductsAjax.php modules/uploads/uploadsAjax.php modules/Dashboard/DashboardAjax.php modules/Potentials/PotentialsAjax.php modules/Notes/NotesAjax.php modules/Faq/FaqAjax.php modules/Quotes/QuotesAjax.php modules/Utilities/UtilitiesAjax.php modules/Calendar/ActivityAjax.php modules/Calendar/CalendarAjax.php modules/PurchaseOrder/PurchaseOrderAjax.php modules/HelpDesk/HelpDeskAjax.php modules/Invoice/InvoiceAjax.php modules/Accounts/AccountsAjax.php modules/Reports/ReportsAjax.php modules/Contacts/ContactsAjax.php and modules/Portal/PortalAjax.php; and allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the step parameter in an Import action to the (4) Accounts (5) Contacts (6) HelpDesk (7) Leads (8) Potentials (9) Products or (10) Vendors module reachable through index.php and related to modules/Import/index.php and multiple Import.php files.