Main
Vulnerability Database
Exploits
ID:6678 - Exploit for Code Injection in FreePBX - CVE-2012-4869
ID:6678 - Exploit for Code Injection in FreePBX - CVE-2012-4869
Published: September 1, 2021
Vulnerability identifier: #VU43620
Vulnerability risk: Medium
CVE-ID: CVE-2012-4869
CWE-ID: CWE-94
Exploitation vector: Remote access
Vulnerable software:
FreePBX
FreePBX
Link to public exploit:
Vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.
Remediation
Install update from vendor's website.