Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2009-05-28 14:30
Updated : 2024-02-04 17:33
NVD link : CVE-2009-1801
Mitre link : CVE-2009-1801
CVE.ORG link : CVE-2009-1801
JSON object : View
Products Affected
freepbx
- freepbx
sangoma
- freepbx
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')