CVE-2013-4467

CVE-2013-4467 affects VICIdial's web interface (agent interface: agc/) and specifically the file agc/manager_send.php. The root cause is unsanitized user input used to build shell commands via PHP passthru(), enabling command execution. Affected versions include VICIdial 2.8-403a, 2.7, and 2.7RC1...

VICIdial Manager Send OS Command Injection

The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...