FreePBX admin/cdr/call-comp.php 'dst' Parameter SQLi

The version of FreePBX installed on the remote host is affected by a SQL injection vulnerability involving the 'dst' parameter as used in the 'admin/cdr/call-comp.php' script. An unauthenticated, remote attacker can leverage this issue to launch a SQL injection attack against the affected...

CVE-2010-3490

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. dot dot in the usersnum parameter to admin/config.php, as...

Directory traversal

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. dot dot in the usersnum parameter to admin/config.php, as...

CVE-2010-3490

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. dot dot in the usersnum parameter to admin/config.php, as...

CVE-2010-3490

CVE-2010-3490 affects FreePBX

TWSL2010-005: FreePBX recordings interface allows remote code execution

Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product: FreePBX and VOIP solutions...

FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution

Exploit for php platform in category web applications ================================================================== FreePBX = 2.8.0 Recordings Interface Allows Remote Code Execution ================================================================== Vendor: FreePBX http://www.freepbx.org/...

FreePBX 2.8.0 - Recordings Interface Allows Remote Code Execution

Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product: FreePBX and VOIP solutions...

FreePBX 2.8.0 Code Execution

Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product: FreePBX and VOIP solutions...

FreePBX 2.8.0 - Recordings Interface Allows Remote Code Execution

FreePBX 2.8.0 - Recordings Interface Allows Remote Code Execution Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX...

Asterisk Recording Interface Cross Site Request Forgery / Cross Site Scripting / Denial Of Service / Local File Inclusion

Found By: TurboBorland Email: [email protected] Software: Asterisk Recording Interface Date Found: 07/01/2010 Ethical Disclosure: Site down, no other location for project, author can not be found, no one to get in touch with. Submission. Vulnerabilities: LFI steal voicemail only need to supply...

FreePBX / PBXconfig Default Credentials

The remote web server hosts FreePBX or PBXconfig, both of which are web-based interfaces used to control and manage Asterisk. The remote installation of the interface has at least one account configured using default credentials. With this information, an attacker can gain administrative access t...

FreePBX Inbound Route描述存储式跨站脚本漏洞

BUGTRAQ ID: 37849 FreePBX之前被称为Asterisk Management Portal，是IP电话工具Asterisk的标准化实现，可提供Web配置界面和其他工具。 FreePBX的Inbound Route描述部分存在存储式跨站脚本漏洞。已登录用户可以在描述字段输入恶意代码，之后用户查看该页面时就会执行所注入的内容。 FreePBX FreePBX 2.6 FreePBX FreePBX 2.5.x 厂商补丁： FreePBX ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

FreePBX config.php页面SQL注入漏洞

BUGTRAQ ID: 37847 FreePBX之前被称为Asterisk Management Portal，是IP电话工具Asterisk的标准化实现，可提供Web配置界面和其他工具。 FreePBX没有正确地过滤提交给config.php页面的extdisplay参数，远程攻击者可以通过提交恶意的查询请求执行SQL注入攻击。 FreePBX 2.5.1 厂商补丁： FreePBX ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.freepbx.org/trac/changeset/7594...

FreePBX admin/config.php页面口令泄露漏洞

BUGTRAQ ID: 37848 FreePBX之前被称为Asterisk Management Portal，是IP电话工具Asterisk的标准化实现，可提供Web配置界面和其他工具。 可以访问FreePBX的administrators部分的用户可以通过查看html源码获得其他用户的管理员口令。 FreePBX 2.5.x 厂商补丁： FreePBX ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://mirror.freepbx.org/freepbx-2.6.0.tar.gz a href=...

FreePBX 2.5.1 - SQL Injection

FreePBX 2.5.1 - SQL Injection Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running...

Information disclosure in FreePBX 2.5.x

Exploit for unknown platform in category web applications ======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class:...

SQL injection in FreePBX 2.5.1

Exploit for unknown platform in category web applications ============================== SQL injection in FreePBX 2.5.1 ============================== Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010...

Permanent Cross-Site Scripting (XSS) in FreePBX 2.5.x – 2.6.0

Exploit for unknown platform in category web applications ============================================================= Permanent Cross-Site Scripting XSS in FreePBX 2.5.x – 2.6.0 ============================================================= Advisory Name: Permanent Cross-Site Scripting XSS in...

FreePBX 2.5.1 - SQL Injection

Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running FreePBX 2.5.1 Local / Remote:...