PT-2022-7110 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX cdr versions 14.0 through 14.0.5.20 Description: The issue is related to the ajaxHandler function in the ucp/Cdr.class.php file of the FreePBX web interface, which fails to protect against SQL query structure attacks. This can allow a...

The vulnerability of the Rest Phone Apps web interface for controlling IP telephony systems, FreePBX, allows a intruder to execute arbitrary code.

The vulnerability of the Rest Phone Apps web interface for controlling IP telephony systems like FreePBX lies in the ability to inject code into the URL addresses. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...

FreePBX has an unspecified vulnerability

FreePBX formerly known as Asterisk Management Portal is a set of tools for configuring Asterisk IP phone systems via a GUI web-based graphical interface from the FreePBX Freepbx project. freePBX restapps has a security vulnerability that could be exploited by remote attackers to execute arbitrary...

CVE-2021-45461

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

CVE-2021-45461

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

CVE-2021-45461

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

Design/Logic Flaw

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

CVE-2021-45461

CVE-2021-45461 affects FreePBX with restapps (aka Rest Phone Apps) versions 15.0.19.87–15.0.19.88 and 16.0.18.40–16.0.18.41. The vulnerability allows remote attackers to execute arbitrary code. It was exploited in the wild in December 2021. The fixed releases are 15.0.20 and 16.0.19. Remediation:...

CVE-2021-45461

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

VulnCheck KEV: CVE-2021-45461

FreePBX, when restapps aka Rest Phone Apps 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19...

FreePBX 安全漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools for configuring Asterisk IP phone systems via a GUI web-based graphical interface from the FreePBX Freepbx project. freePBX restapps has a security vulnerability that could be exploited by remote attackers to execute arbitrary...

PT-2021-7259

Name of the Vulnerable Software and Affected Versions FreePBX versions 15.0.19.87 through 15.0.19.88 FreePBX versions 16.0.18.40 through 16.0.18.41 Description The issue allows remote attackers to execute arbitrary code. This has been exploited in the wild, with reports of attacks starting in...

FreePBX 13.x <= 13.0.93.2, 14.x <= 14.0.22.2, 15.x <= 15.0.19.2 RCE Vulnerability

FreePBX is prone to a remote code execution RCE vulnerability. NOTE: This VT is reporting a false positive and therefore has been deprecated. The vulnerability exists in the Restapps / Phone apps module and not in the core framework itself. SPDX-FileCopyrightText: 2021 Greenbone AG Some text...

Sangoma FreePBX Code Injection Vulnerability

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX Freepbx project for configuring Asterisk an IP phone system through a GUI web-based graphical interface. A code injection vulnerability exists in Sangoma FreePBX and PBXact versions 13, 14, 15 through 15.0.19....

CVE-2020-10666

The restapps aka Rest Phone apps module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command...

CVE-2020-10666

The restapps aka Rest Phone apps module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command...

CVE-2020-10666

The Restapps (Rest Phone apps) module in Sangoma FreePBX and PBXact (versions 13–15 up to 15.0.19.2) is vulnerable to remote code execution via a URL variable to an AMI command. Root cause is a flaw in Restapps’ handling of AMI commands that allows injection. Impact per sources is high (remote, n...

CVE-2020-10666

The restapps aka Rest Phone apps module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command...

FreePBX 命令注入漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX Freepbx project for configuring Asterisk an IP phone system through a GUI web-based graphical interface. A code injection vulnerability exists in Sangoma FreePBX and PBXact versions 13, 14, 15 through 15.0.19....