PT-2014-2799 · Vicidial · Vicidial Dialer

Adam Caudill · Published 2014-03-11 · Updated 2014-05-20 · CVE-2013-4467

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VICIDIAL dialer versions 2.8-403a, 2.7, 2.7RC1, and earlier

Description The issue concerns SQL injection vulnerabilities in the agent interface of VICIDIAL dialer. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the campaign variable in "SCRIPT multirecording AJAX.php", or remote authenticated users to execute arbitrary SQL commands via the server ip parameter to "manager send.php". There are also other unspecified vectors.

Recommendations For versions 2.8-403a, 2.7, 2.7RC1, and earlier, consider disabling access to the "SCRIPT multirecording AJAX.php" and "manager send.php" scripts until a patch is available. Restrict access to the campaign variable and server ip parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-4467

Affected Products

Vicidial Dialer

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb · Exploit
• 🔥 http://seclists.org/oss-sec/2013/q4/175 · Exploit
• 🔥 http://securityfocus.com/bid/63340 · Exploit
• 🔥 http://exploit-db.com/exploits/29513 · Exploit
• 🔥 http://seclists.org/oss-sec/2013/q4/171 · Exploit
• 🔥 https://exploit-db.com/exploits/29513 · Exploit
• 🔥 https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities · Exploit
• http://secunia.com/advisories/55453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4467 · Security Note
• http://osvdb.org/98903 · Note