FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command into the database). To trigger the command, one needs to call the services.php file via a GET request with the service id followed by the parameter a=start to execute the stored command.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2019-09-05T20:46:38
Updated: 2024-08-05T00:34:53.156Z
Reserved: 2019-08-14T00:00:00
Link: CVE-2019-15029
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2019-09-05T21:15:31.093
Modified: 2020-08-24T17:37:01.140
Link: CVE-2019-15029
Redhat
No data.