SQL Injection Vulnerabilities in VICIDIAL Dialer by VICIdial Group
CVE-2013-4467
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 78%
What is CVE-2013-4467?
Multiple SQL injection vulnerabilities exist within the agent interface of VICIDIAL dialer, allowing remote attackers to execute arbitrary SQL commands. This can be achieved via manipulation of campaign variables in SCRIPT_multirecording_AJAX.php and through the server_ip parameter in manager_send.php by authenticated users. Additional unspecified vectors also pose a risk, leading to potential data breaches and unauthorized access.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.