FreePBX - 'config.php' Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "FreePBX config.php Remote Code Execution", 'Description' = %q This module exploits a vulnerability found in FreePBX version 2.9, 2.10...

FreePBX config.php Remote Code Execution

This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11. It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php" parameters "function" and "args". Module Options msf use exploit/unix/webapp/freepbx/configexec msf undefinedconfigexec show...

FreePBX 2.9 - 12 RCE Vulnerability - Active Check

FreePBX is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freepbx:freepbx"; ...

FreePBX 2.11.0 - Remote Command Execution

FreePBX 2.11.0 - Remote Command Execution !/usr/bin/perl use strict; use warnings; use IO::Socket::INET; Exploit Title: FreePBX 2.9,2.10,2.11,12 Remote Command Execution Google Dork: n/a Date: 2/25/14 Exploit Author: @0x00string Vendor Homepage: http://www.freepbx.org/ Software Link:...

CVE-2014-1903

creationtimestamp| type| source ---|---|--- 2014-03-12 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32214 2014-03-25 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32512 2018-05-29 15:50:33+00:00| seen|...

FreePBX 2.11.0 - Remote Command Execution

!/usr/bin/perl use strict; use warnings; use IO::Socket::INET; Exploit Title: FreePBX 2.9,2.10,2.11,12 Remote Command Execution Google Dork: n/a Date: 2/25/14 Exploit Author: @0x00string Vendor Homepage: http://www.freepbx.org/ Software Link: http://mirror.freepbx.org/freepbx-2.11.0.tar.gz Versio...

CVE-2014-1903

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args...

CVE-2014-1903

Summary: FreePBX versions 2.9 (before 2.9.0.14), 2.10 (before 2.10.1.15), 2.11 (before 2.11.0.23), and 12 (before 12.0.1alpha22) are vulnerable because admin/libraries/view.functions.php does not restrict the API handler’s function set, enabling remote attackers to execute arbitrary PHP code via ...

CVE-2013-1903

CVE-2013-1903 affects PostgreSQL 8.3.x before 8.3.23, 8.4.x before 8.4.17, 9.0.x before 9.0.13, 9.1.x before 9.1.9, and 9.2.x before 9.2.4. Two issues are noted: (1) EnterpriseDB installers for Linux/Mac OS X create a /tmp directory and file with predictable names (CVE-2013-1902). (2) The Postgre...

CVE-2011-1903

The entry CVE-2011-1903 describes a SQL injection vulnerability in an unspecified function of Proofpoint Messaging Security Gateway (versions up to 6.2.0.263:6.2.0.237) and Proofpoint Protection Server (5.5.3–5.5.5, 6.0.2, 6.1.1, 6.2.0). The vulnerability allows remote attackers to execute arbitr...

Fedora Update for telepathy-gabble FEDORA-2011-1903

Check for the Version of telepathy-gabble OpenVAS Vulnerability Test Fedora Update for telepathy-gabble FEDORA-2011-1903 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modi...

CVE-2010-1903

CVE-2010-1903 is a Word HTML Linked Objects Memory Corruption vulnerability affecting Microsoft Office Word/Word Viewer. A remote attacker could trigger memory corruption by processing a specially crafted Word file, leading to remote code execution or potential denial of service. Public disclosur...

Microsoft Office Word HTML Linked Objects Memory Corruption Vulnerability - CVE-2010-1903

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Microsoft Office Word HTML Linked Objects Memory Corruption Vulnerabilit...

Microsoft Word HTML Linked Objects Memory Corruption (MS10-056; CVE-2010-1903)

Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in Microsoft Word. The vulnerability is due to an error in Microsoft Word that fails to properly parse specially crafted Word files. A remote attacker could trigger this flaw by...

Fedora Update for mod_security FEDORA-2010-1903

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Debian DSA-1903-1 : graphicsmagick - several vulnerabilities

Several vulnerabilities have been discovered in graphicsmagick, a collection of image processing tool, which can lead to the execution of arbitrary code, exposure of sensitive information or cause DoS. The Common Vulnerabilities and Exposures project identifies the following problems : -...

Debian: Security Advisory (DSA-1903-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200907-02 (mod_security)

The remote host is missing updates announced in advisory GLSA 200907-02. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2009-1903

ModSecurity (Apache module) prior to version 2.5.9 is affected by two CVEs; CVE-2009-1902 (NULL pointer dereference when processing multipart requests without a part header name) and CVE-2009-1903 (PDF XSS protection failing for PDF requests not using GET), leading to possible denial of service (...

Fedora Core 10 FEDORA-2009-2686 (mod_security)

The remote host is missing an update to modsecurity announced via advisory FEDORA-2009-2686. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...