Mil1200

FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client id to obtain OAuth2 access tokens without providing the correct client secret. This vulnerability is fixed in 17.0.8.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions prior to 16.0.50 FreePBX versions prior to 17.0.11 **Description** The CDR Reports module page allows SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs through the `order` and `sort` POST parameters. Exploitation requires authentication with a FreePBX Administration Control Panel account that has access to the CDR section, although full administrator privileges are not necessary. **Recommendations** Update to version 16.0.50. Update to version 17.0.11.

FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $ REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.