CVE-2013-4467

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-4467
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors. NOTE: some of these details are obtained from third party information.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/98903
http://seclists.org/oss-sec/2013/q4/171 Exploit
http://seclists.org/oss-sec/2013/q4/175 Exploit
http://secunia.com/advisories/55453 Vendor Advisory
http://www.exploit-db.com/exploits/29513
http://www.securityfocus.com/bid/63340 Exploit
https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities Exploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb Exploit
http://osvdb.org/98903
http://seclists.org/oss-sec/2013/q4/171 Exploit
http://seclists.org/oss-sec/2013/q4/175 Exploit
http://secunia.com/advisories/55453 Vendor Advisory
http://www.exploit-db.com/exploits/29513
http://www.securityfocus.com/bid/63340 Exploit
https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities Exploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vicidial:vicidial:*:-:*:*:*:*:*:*
cpe:2.3:a:vicidial:vicidial:2.7:rc1:*:*:*:*:*:*
cpe:2.3:a:vicidial:vicidial:2.8:403a:*:*:*:*:*:*
History

21 Nov 2024, 01:55

Type Values Removed Values Added
References () http://osvdb.org/98903 - () http://osvdb.org/98903 -
References () http://seclists.org/oss-sec/2013/q4/171 - Exploit () http://seclists.org/oss-sec/2013/q4/171 - Exploit
References () http://seclists.org/oss-sec/2013/q4/175 - Exploit () http://seclists.org/oss-sec/2013/q4/175 - Exploit
References () http://secunia.com/advisories/55453 - Vendor Advisory () http://secunia.com/advisories/55453 - Vendor Advisory
References () http://www.exploit-db.com/exploits/29513 - () http://www.exploit-db.com/exploits/29513 -
References () http://www.securityfocus.com/bid/63340 - Exploit () http://www.securityfocus.com/bid/63340 - Exploit
References () https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities - Exploit () https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities - Exploit
References () https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb - Exploit () https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb - Exploit
Information

Published : 2014-03-11 19:37

Updated : 2025-04-12 10:46

NVD link : CVE-2013-4467

Mitre link : CVE-2013-4467

CVE.ORG link : CVE-2013-4467

JSON object : View

Products Affected

vicidial

  • vicidial
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')