Threat database

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

FusionPBX versions through 5.6.5 contain an OS command injection vulnerability in the call_recordings::download() function. This flaw allows unauthenticated attackers to execute arbitrary commands by placing calls with malicious caller ID values that include shell metacharacters. When the record_name filename template is enabled, these commands execute as the web server user when a privileged user downloads multiple recordings as a ZIP archive. The vulnerability has a high severity score of 7.5 CVSS 3.1.

FusionPBX before 5.2.0 does not validate a session.

FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.