180 matches found
CVE-2013-7382
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the 1 VDAD and 2 VDCL users, which makes it easier for remote attackers to obtain access...
CVE-2013-7382: Undefined Security Weakness
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the 1 VDAD and 2 VDCL users, which makes it easier for remote attackers to obtain access...
PT-2014-3407
Name of the Vulnerable Software and Affected Versions VICIDIAL dialer aka Asterisk GUI client versions 2.8-403a, 2.7, 2.7RC1, and earlier Description The issue allows remote attackers to obtain access more easily due to a hardcoded password 'donotedit' for the VDAD and VDCL users. Recommendations...
CVE-2013-4468
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to managersend.php...
Code injection
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to managersend.php...
CVE-2013-4468
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to managersend.php...
CVE-2013-4468
CVE-2013-4468 concerns VICIDIAL dialer (Asterisk GUI client) where remote authenticated users can execute arbitrary commands via shell metacharacters in the extension parameter of an OriginateVDRelogin action to manager_send.php. Affected versions include 2.7RC1, 2.7, and 2.8-403a and earlier. Th...
CVE-2013-4468: Undefined Security Weakness
VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to managersend.php...
PT-2014-2800
Name of the Vulnerable Software and Affected Versions VICIDIAL dialer aka Asterisk GUI client versions 2.8-403a, 2.7, 2.7RC1, and earlier Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an...
VICIdial Manager Send OS Command Injection (CVE-2013-4468)
An OS Command Injection vulnerability has been reported in VICIdial Manager. The vulnerability is due to a web application uses unsanitized user input. A remote attacker could trigger this flaw by using a crafted SQL parameter value...
CVE-2013-4467
Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...
Sql injection
Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...
CVE-2013-4467
Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...
CVE-2013-4467
CVE-2013-4467 affects VICIdial's web interface (agent interface: agc/) and specifically the file agc/manager_send.php. The root cause is unsanitized user input used to build shell commands via PHP passthru(), enabling command execution. Affected versions include VICIdial 2.8-403a, 2.7, and 2.7RC1...
PT-2014-2799
Name of the Vulnerable Software and Affected Versions VICIDIAL dialer versions 2.8-403a, 2.7, 2.7RC1, and earlier Description The issue concerns SQL injection vulnerabilities in the agent interface of VICIDIAL dialer. These vulnerabilities allow remote attackers to execute arbitrary SQL commands...
CVE-2013-4467: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...
VICIdial Manager - Send OS Command Injection (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'VICIdial Manager Send OS Command Injection', 'Description' = %q The file agc/managersend.php in the VICIdial web application uses...
VICIdial Manager Send OS Command Injection
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'VICIdial Manager Send OS Command Injection', 'Description' = %q The file agc/managersend.php in the VICIdial web application uses...
VICIdial Manager Send OS Command Injection Vulnerability
The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...
VICIdial 'manager_send.php' Command Injection Vulnerability
VICIdial is prone to a command-injection vulnerability because the application fails to properly sanitize user-supplied input. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...