Design/Logic Flaw

2019-10-2116:15:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.9%

JSON

In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized “rec” variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.

CPENameOperatorVersion
fusionpbxle4.5.7

CPE	Name	Operator	Version
	fusionpbx	le	4.5.7

References

github.com/fusionpbx/fusionpbx/commit/284b0a91968f126fd6be0a486a84e065926905ca

resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-1/