Elastix-2.2.0-CVE-2012-4869

Elastix 2.2.0 Local File Inclusion Exploit - CVE-2012-4869 Description This script exploits a Local File Inclusion LFI vulnerability in Elastix 2.2.0 , allowing remote code execution RCE by injecting commands via the callmepage.php endpoint. The exploit is based on CVE-2012-4869. Features Bypasse...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

Elastix - graph.php LFI Detection

Detects Elastix vtigercrm/graph.php currentlanguage LFI to /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastix ...

Exploits

Exploit FreePBX / Elastix - callmepage.php Auteur : LECOMT...

EUVD-2012-6455

Malware in sbrugna...

EUVD-2015-1981

Malware in sbrugna...

EUVD-2010-1519

Malware in sbrugna...

CVE-2012-6608

Cross-site scripting XSS vulnerability in xmlservices/Ebook.php in Elastix 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the Page parameter...

CVE-2010-1492

Directory traversal vulnerability in help/frameRight.php in Elastix 1.6.0 allows remote attackers to read arbitrary files via a .. dot dot in the idnodo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...

Elastix Detection (HTTP)

HTTP based detection of Elastix. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.117269";...

Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies

Cybersecurity researchers today took the wraps off an on-going cyber fraud operation led by hackers in Gaza, West Bank, and Egypt to compromise VoIP servers of more than 1,200 organizations across 60 countries over the past 12 months. According to findings published by Check Point Research, the...

Elastix 2.5 - PHP Code Injection

Elastix 2.5 - PHP Code Injection '; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent = "Mozilla/5.0 Windows; U;...

Elastix 2.5 PHP Code Injection Exploit

Exploit for php platform in category web applications '; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent =...

Elastix < 2.5 - PHP Code Injection

'; $faf=fopen"fa.txt","w+"; fwrite$faf,$inj; fclose$faf; $myf='fa.txt'; $url = $target."/vtigercrm/phprint.php?action=fa&module=ff&langcrm=../../modules/Import/ImportStep2.php%00"; // URL $reffer = "http://1337s.cc/index.php"; $agent = "Mozilla/5.0 Windows; U; Windows NT 5.0; en-US; rv:1.4...

Elastix 2.5 /a2billing/customer/iridium_thread.php SQL注入漏洞

No description provided by source...

Elastix transactionID SQL Injection Vulnerability

Elastix is an Asterisk PBX operating tool. A SQL injection vulnerability in the Elastix a2billing/customer/iridiumthreed.php script handling transactionID allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

Elastix 'a2billing/customer/iridium_threed.php' SQL Injection Vulnerability

Ecuadorian Based Elastix is a suite of open source unified communications server software from Ecuadorian Based. The software provides IP PBX, e-mail, instant messaging, fax and collaboration. Elastix 'a2billing/customer/iridiumthreed.php' has a SQL injection vulnerability that can be exploited b...

CVE-2015-1875

SQL injection vulnerability in a2billing/customer/iridiumthreed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter...

Sql injection

SQL injection vulnerability in a2billing/customer/iridiumthreed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter...