FreePBX 2.9 Remote Command Execution

Title: FreePBX 2.9 Backup Module Remote Command Execution Vulnerability Author: Ahmed Aboul-Ela Contact: Ahmed.Aboul3laatgmaildotcom Vendor: http://www.freepbx.org Software Link: http://mirror.freepbx.org/freepbx-2.9.0.tar.gz Version: 2.9 and prior versions should be affected too Tested on: Linux...

CVE-2012-4869

The callmestartcall function in recordings/misc/callmepage.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action...

CVE-2012-4870

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

Deserialization of untrusted data

The callmestartcall function in recordings/misc/callmepage.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

CVE-2012-4869

The callmestartcall function in recordings/misc/callmepage.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action...

CVE-2012-4870

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

CVE-2012-4869

CVE-2012-4869 is an RCE vulnerability in FreePBX where the callme_startcall function in recordings/misc/callme_page.php allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action, affecting FreePBX 2.9 and earlier. Exploitation details and impact are supported...

CVE-2012-4870

This CVE concerns FreePBX 2.9 and earlier, where multiple cross-site scripting (XSS) vulnerabilities exist in the web UI. The affected components/entry points include: (1) panel/index_amp.php via the context parameter; (2) panel/dhtml/index.php; (3) panel/flash/mypage.php via clid or clidname; (4...

PT-2012-5621 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.9 and earlier Description: The issue allows remote attackers to execute arbitrary commands. This is achieved through the callmenum parameter in a 'c' action, specifically targeting the callme startcall function in...

CVE-2012-4870: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

CVE-2012-4869: Improper Control of Generation of Code

The callmestartcall function in recordings/misc/callmepage.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action...

PT-2012-5622

Name of the Vulnerable Software and Affected Versions FreePBX versions 2.9 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved through various parameters and endpoints, including the conte...

CVE-2012-4869

The callmestartcall function in recordings/misc/callmepage.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Elastix 2.2.0 Local File Inclusion

!/usr/bin/perl -w ------------------------------------------------------------------------------------ Elastix is an Open Source Sofware to establish Unified Communications. About this concept, Elastix goal is to incorporate all the communication alternatives, available at an enterprise level, in...

Elastix 2.2.0 LFI Exploit

Exploit for php platform in category web applications !/usr/bin/perl -w ------------------------------------------------------------------------------------ Elastix is an Open Source Sofware to establish Unified Communications. About this concept, Elastix goal is to incorporate all the...

FreePBX callmenum Remote Code Execution

Added: 05/02/2012 BID: 52630 OSVDB: 80544 Background FreePBX is an open source telephony front-end, which has an easy to use graphical user interface that controls and manages Asterisk. Problem FreePBX fails to properly sanitize user-supplied input passed to 'callmenum' parameter in...

FreePBX callmenum Remote Code Execution

Added: 05/02/2012 BID: 52630 OSVDB: 80544 Background FreePBX is an open source telephony front-end, which has an easy to use graphical user interface that controls and manages Asterisk. Problem FreePBX fails to properly sanitize user-supplied input passed to 'callmenum' parameter in...

FreePBX callmenum Remote Code Execution

Added: 05/02/2012 BID: 52630 OSVDB: 80544 Background FreePBX is an open source telephony front-end, which has an easy to use graphical user interface that controls and manages Asterisk. Problem FreePBX fails to properly sanitize user-supplied input passed to 'callmenum' parameter in...

FreePBX callmenum Remote Code Execution

Added: 05/02/2012 BID: 52630 OSVDB: 80544 Background FreePBX is an open source telephony front-end, which has an easy to use graphical user interface that controls and manages Asterisk. Problem FreePBX fails to properly sanitize user-supplied input passed to 'callmenum' parameter in...