Sangoma FreePBX any version

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.

FreePBX cdr Cdr.class.php ajaxHandler sql injection

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

Authenticated Command Injection in FreePBX UCP Interface

Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.

FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

FreePBX Post-Authenticated Command Injection

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports

FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module

FreePBX: Authenticated Local File Inclusion in Dashboard Module

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

FreePBX vulnerable to unauthenticated Denial of Service

FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes

In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation.

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root.

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.

FreePBX arimanager Views cross site scripting

Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account.

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4.

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not being properly sanitized. If this is done and a user (such as an admin) visits the User Management screen and views that user's profile, the XSS payload will render and execute in the context of the victim user's account.