CVE-2014-1903

🗓️ 18 Feb 2014 11:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 115 Views🌐 WEB

FreePBX Remote Code Execution vulnerability

Reporter	Title	Published	Views	Family All 24
zdt	FreePBX config.php Remote Code Execution Vulnerability	25 Mar 201400:00	–	zdt
Circl	CVE-2014-1903	12 Mar 201400:00	–	circl
Check Point Advisories	FreePBX config php Code Execution (CVE-2014-1903)	18 May 201400:00	–	checkpoint_advisories
Cvelist	CVE-2014-1903	18 Feb 201411:00	–	cvelist
Exploit DB	FreePBX 2.11.0 - Remote Command Execution	12 Mar 201400:00	–	exploitdb
Exploit DB	FreePBX - 'config.php' Remote Code Execution (Metasploit)	25 Mar 201400:00	–	exploitdb
exploitpack	FreePBX 2.11.0 - Remote Command Execution	12 Mar 201400:00	–	exploitpack
KittySploit	FreePBX - API handler system() RCE (CVE-2014-1903)	10 Aug 202606:19	–	kittysploit
KittySploit	FreePBX - API handler system() Detection (CVE-2014-1903)	10 Aug 202606:19	–	kittysploit
Mend	CVE-2014-1903	18 Feb 201411:00	–	mend

NVD

Node

OR

freepbx freepbxMatch2.10

freepbx freepbxMatch2.11

freepbx freepbxMatch2.12

sangoma freepbxMatch2.9

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html
github	www.github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl
code	www.code.freepbx.org/changelog/FreePBX_Framework
archives	www.archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html
issues	www.issues.freepbx.org/browse/FREEPBX-7117
osvdb	www.osvdb.org/103240
packetstormsecurity	www.packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html
issues	www.issues.freepbx.org/browse/FREEPBX-7123
securityfocus	www.securityfocus.com/archive/1/531040/100/0/threaded
code	www.code.freepbx.org/changelog/FreePBX_SVN

Parameter	Position	Path	Description	CWE
function	query param	admin/config.php	Remote code execution via FreePBX API handler: arbitrary PHP function execution using function and args parameters in admin/config.php.	CWE-264
args	query param	admin/config.php	Remote code execution via FreePBX API handler: arbitrary PHP function execution using function and args parameters in admin/config.php.	CWE-264

17 Jun 2026 00:05Current

7.5High risk

Vulners AI Score7.5

CVSS 27.5

EPSS0.5181

freepbx remote code execution cve-2014-1903 nvd security advisory