Exploits

Exploit FreePBX / Elastix - callmepage.php Auteur : LECOMT...

EUVD-2015-1981

Malware in sbrugna...

EUVD-2012-6455

Malware in sbrugna...

EUVD-2010-1519

Malware in sbrugna...

CVE-2012-6608

Cross-site scripting XSS vulnerability in xmlservices/Ebook.php in Elastix 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the Page parameter...

CVE-2010-1492

Directory traversal vulnerability in help/frameRight.php in Elastix 1.6.0 allows remote attackers to read arbitrary files via a .. dot dot in the idnodo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...

Elastix Detection (HTTP)

HTTP based detection of Elastix. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.117269";...

Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies

Cybersecurity researchers today took the wraps off an on-going cyber fraud operation led by hackers in Gaza, West Bank, and Egypt to compromise VoIP servers of more than 1,200 organizations across 60 countries over the past 12 months. According to findings published by Check Point Research, the...

Elastix 2.5 - PHP Code Injection

Elastix 2.5 - PHP Code Injection '; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent = "Mozilla/5.0 Windows; U;...

Elastix 2.5 PHP Code Injection Exploit

Exploit for php platform in category web applications '; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent =...

Elastix < 2.5 - PHP Code Injection

'; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent = "Mozilla/5.0 Windows; U; Windows NT 5.0; en-US; rv:1.4...

Elastix 2.5 /a2billing/customer/iridium_thread.php SQL注入漏洞

No description provided by source...

Elastix transactionID SQL Injection Vulnerability

Elastix is an Asterisk PBX operating tool. A SQL injection vulnerability in the Elastix a2billing/customer/iridiumthreed.php script handling transactionID allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

Elastix 'a2billing/customer/iridium_threed.php' SQL Injection Vulnerability

Ecuadorian Based Elastix is a suite of open source unified communications server software from Ecuadorian Based. The software provides IP PBX, e-mail, instant messaging, fax and collaboration. Elastix 'a2billing/customer/iridiumthreed.php' has a SQL injection vulnerability that can be exploited b...

CVE-2015-1875

SQL injection vulnerability in a2billing/customer/iridiumthreed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter...

Sql injection

SQL injection vulnerability in a2billing/customer/iridiumthreed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter...

CVE-2015-1875

Elastix 2.5.0 and earlier is affected by an SQL injection in a2billing/customer/iridium_threed.php, exploitable via the transactionID parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands, potentially impacting data confidentiality and integrity and possibly other...

CVE-2015-1875

SQL injection vulnerability in a2billing/customer/iridiumthreed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter...

Elastix 2.x - Blind SQL Injection

Elastix 2.x - Blind SQL Injection Title: Elastix v2.x Blind SQL Injection Vulnerability Author: Ahmed Aboul-Ela Twitter: https://twitter.com/aboul3la Vendor : http://www.elastix.org Version: v2.5.0 and prior versions should be affected too - Vulnerable Source Code snippet in...