{"id": "CVE-2003-0779", "bulletinFamily": "NVD", "title": "CVE-2003-0779", "description": "SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID string.", "published": "2003-09-22T04:00:00", "modified": "2008-09-10T19:20:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0779", "reporter": "cve@mitre.org", "references": ["http://www.atstake.com/research/advisories/2003/a091103-1.txt"], "cvelist": ["CVE-2003-0779"], "type": "cve", "lastseen": "2019-05-29T18:07:57", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "3f4e76d0c130cb6f83e51830915cba9e"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "eb8a2b8e03b89f75910c753ecc2ee5b0"}, {"key": "cpe23", "hash": "beb6a5c670061327ac696dde339fc585"}, {"key": "cvelist", "hash": "5f374664134f826f8a991cb1cf8a3c7f"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "7f7c77d2dde7216a66d00321bd5828f8"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "4458ee20db50b7eb094cce9e2c5357a5"}, {"key": "href", "hash": "c6371202838e97989720d76a47f779c1"}, {"key": "modified", "hash": "4305089d05df75c5fa22251dab1255a4"}, {"key": "published", "hash": "399c63c328a45c7d57d2883f9ebb6c93"}, {"key": "references", "hash": "7e0d0894f38c2433b83e08e290df2bb9"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "eccd69cb0de0c7f7a16d727611b79cd4"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "3a2eb29a726310ac30ee61c5b7b4375fcc61ac49aa176644d3dd12fc8dc5f637", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:2547"]}], "modified": "2019-05-29T18:07:57"}, "score": {"value": 7.5, "vector": "NONE", "modified": "2019-05-29T18:07:57"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:digium:asterisk:0.1.9.1", "cpe:/a:digium:asterisk:0.1.7", "cpe:/a:digium:asterisk:0.2", "cpe:/a:digium:asterisk:0.4", "cpe:/a:digium:asterisk:0.1.8", "cpe:/a:digium:asterisk:0.1.9", "cpe:/a:digium:asterisk:0.3"], "affectedSoftware": [{"name": "digium asterisk", "operator": "eq", "version": "0.1.7"}, {"name": "digium asterisk", "operator": "eq", "version": "0.3"}, {"name": "digium asterisk", "operator": "eq", "version": "0.2"}, {"name": "digium asterisk", "operator": "eq", "version": "0.1.8"}, {"name": "digium asterisk", "operator": "eq", "version": "0.1.9"}, {"name": "digium asterisk", "operator": "eq", "version": "0.4"}, {"name": "digium asterisk", "operator": "eq", "version": "0.1.9.1"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:digium:asterisk:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:0.1.9.1:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:19:57", "bulletinFamily": "software", "description": "## Vulnerability Description\nAsterick contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the \"CallerID\" variable in the Call Detail Records (CDR) module is not verified properly and will allow an attacker to inject or manipulate SQL queries.\n## Solution Description\nUpgrade to version 0.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nAsterick contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the \"CallerID\" variable in the Call Detail Records (CDR) module is not verified properly and will allow an attacker to inject or manipulate SQL queries.\n## References:\nVendor URL: http://www.asterisk.org/\n[Secunia Advisory ID:9718](https://secuniaresearch.flexerasoftware.com/advisories/9718/)\nOther Advisory URL: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0102.html\nOther Advisory URL: http://www.atstake.com/research/advisories/2003/a091103-1.txt\nISS X-Force ID: 13172\n[CVE-2003-0779](https://vulners.com/cve/CVE-2003-0779)\nBugtraq ID: 8599\n", "modified": "2003-09-13T07:30:55", "published": "2003-09-13T07:30:55", "href": "https://vulners.com/osvdb/OSVDB:2547", "id": "OSVDB:2547", "type": "osvdb", "title": "Asterisk CallerID SQL Injection ", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}