FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
References
Link | Resource |
---|---|
https://wiki.freepbx.org/display/FOP/2018-09-11+DISA+SQL+Injection | Vendor Advisory |
https://www.freepbx.org/ | Product |
Configurations
History
No history.
Information
Published : 2019-06-20 17:15
Updated : 2024-02-04 20:20
NVD link : CVE-2018-15892
Mitre link : CVE-2018-15892
CVE.ORG link : CVE-2018-15892
JSON object : View
Products Affected
freepbx
- disa
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')