Remote Command Execution Vulnerability in FreePBX Products by Sangoma
CVE-2012-4869
Key Information:
Badges
What is CVE-2012-4869?
The callme_startcall function in the recordings/misc/callme_page.php file of FreePBX versions 2.9, 2.10, and earlier exposes a significant security risk. This vulnerability allows remote attackers to execute arbitrary commands through manipulation of the callmenum parameter in a specific action. By exploiting this flaw, an attacker can gain unauthorized control over the affected system, potentially leading to further compromise. It is crucial for users of affected FreePBX versions to apply the necessary patches and consider security best practices to safeguard their systems.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.