PT-2014-2799 · Vicidial · Vicidial Dialer

Adam Caudill · Publicado 2014-03-11 · Atualizado 2014-05-20 · CVE-2013-4467

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VICIDIAL dialer versions 2.8-403a, 2.7, 2.7RC1, and earlier

Description The issue concerns SQL injection vulnerabilities in the agent interface of VICIDIAL dialer. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the campaign variable in "SCRIPT multirecording AJAX.php", or remote authenticated users to execute arbitrary SQL commands via the server ip parameter to "manager send.php". There are also other unspecified vectors.

Recommendations For versions 2.8-403a, 2.7, 2.7RC1, and earlier, consider disabling access to the "SCRIPT multirecording AJAX.php" and "manager send.php" scripts until a patch is available. Restrict access to the campaign variable and server ip parameter to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-4467

Produtos afetados

Vicidial Dialer

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb · Exploit
• 🔥 http://seclists.org/oss-sec/2013/q4/175 · Exploit
• 🔥 http://securityfocus.com/bid/63340 · Exploit
• 🔥 http://exploit-db.com/exploits/29513 · Exploit
• 🔥 http://seclists.org/oss-sec/2013/q4/171 · Exploit
• 🔥 https://exploit-db.com/exploits/29513 · Exploit
• 🔥 https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities · Exploit
• http://osvdb.org/98903 · Nota
• http://secunia.com/advisories/55453 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4467 · Nota de Segurança