Mil1200

**Name of the Vulnerable Software and Affected Versions** FreePBX versions prior to 17.0.8 **Description** The OAuth2 implementation in the api module fails to properly validate client credentials during token issuance. Specifically, the `validateClient()` function in ClientRepository.php unconditionally returns true. This allows an attacker who knows a valid `client id` to obtain OAuth2 access tokens without providing the required `client secret`. **Recommendations** Update to version 17.0.8.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions prior to 16.0.50 FreePBX versions prior to 17.0.11 **Description** The CDR Reports module page allows SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs through the `order` and `sort` POST parameters. Exploitation requires authentication with a FreePBX Administration Control Panel account that has access to the CDR section, although full administrator privileges are not necessary. **Recommendations** Update to version 16.0.50. Update to version 17.0.11.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions prior to 16.0.22 FreePBX versions prior to 17.0.5 **Description** The Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without proper path sanitization. By using path traversal sequences such as ../ in the `rawname` parameter, an attacker can include arbitrary .class.php files from the filesystem. The PHP code within the included file is executed before a class instantiation error occurs. **Recommendations** Update to version 16.0.22. Update to version 17.0.5.