ID:270 - Exploit for Command Injection in FusionPBX - CVE-2019-15029

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to a lack of input validation in the "service_edit.php" file. A remote authenticated attacker can call the "services.php" file via a GET request with the service id followed by the parameter "a=start" and execute the stored command.