CVE-2009-1801: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the 1 display parameter to reports.php, the 2 order and 3 extdisplay parameters to config.php, and the 4 so...

CVE-2009-1802: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact...

FreePBX跨站脚本和信息泄漏漏洞

Bugraq ID: 34857 CNCAN ID：CNCAN-2009050801 FreePBX是一款用来控制Asterisk的图形化接口。 FreePBX存在多个安全问题，远程攻击者可以利用漏洞获得系统敏感信息或进行跨站脚本攻击。 -reports.php脚本对"display"参数，config.php对"order"和"extdisplay"参数，recordings/index.php脚本对"sort"参数在返回用户前缺少过滤，可导致在用户浏览器会话中执行任意HTML和脚本代码。...

phone-sqlxss.txt

In a previous post http://seclists.org/fulldisclosure/2007/Oct/0174.html , we have seen how XSS injection can be performed over SIP to inject malicious JavaScript into the browser of an user that check the call history of his phone. In this post, we will detail how XSS injection can be performed...

Code injection

admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter...

CVE-2007-2350

The CVE concerns admin/config.php in the music-on-hold module of freePBX 2.2.x. It allows a remote authenticated administrator to execute arbitrary commands via shell metacharacters in the del parameter, indicating input handling/sanitization flaws in that file. Impact is potential remote command...

CVE-2007-2350: Undefined Security Weakness

admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-2191

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-2191

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-2191

CVE-2007-2191 describes multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.2.x . The flaws allow remote attackers to inject arbitrary web script or HTML via SIP-related fields (1) From, (2) To, (3) Call-ID, (4) User-Agent, and potentially other SIP headers, with the malicious data s...

asterisk-inject.txt

I've found a code injection in the music-on-hold module at freePBX's portal. There are Inssuficient filters in the delete functions. Only " ' and ; are being filtered. Vulnerable Lines: 300: $rmcmd="rm -f "".$pathtodir."/". $del."""; 301: exec$rmcmd; Example code:...

CVE-2007-2191: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

meth-xss.txt

!/usr/bin/php -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-= ISSUE: SIP protocol's fields such as From, To, Call-ID, User-Agent and many others can carry html tags, wich are shown unfiltered by the Asterisk Log File tools located at...

[Full-disclosure] freePBX 2.2.x's Music-on-hold Remote Code Execution Injection

I've found a code injection in the music-on-hold module at freePBX's portal. There are Inssuficient filters in the delete functions. Only " ' and ; are being filtered. Vulnerable Lines: 300: $rmcmd="rm -f "".$pathtodir."/". $del."""; 301: exec$rmcmd; Example code:...

FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities

FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/23575/info FreePBX is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data before using it in dynamically generated content...

FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/23575/info FreePBX is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data before using it in dynamically generated content. Attacker-supplied HTML and script code may be executed in the conte...

CVE-2006-7107

PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ampconfAMPWEBROOT parameter...

CVE-2006-7107

CVE-2006-7107 is a PHP remote file inclusion vulnerability in upgrade.php of Coalescent Systems freePBX 2.1.3. The issue allows remote attackers to execute arbitrary PHP code via a URL in the amp_conf[AMPWEBROOT] parameter, due to inadequate input handling. The linked sources (NVD and CVE listing...

CVE-2006-7107

PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ampconfAMPWEBROOT parameter...