PT-2022-11389 · Unknown · Voipmonitor Web Gui

Published 2022-06-17 · Updated 2022-06-27 · CVE-2021-41408

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VoIPmonitor WEB GUI versions up to 24.61

Description The issue affects the VoIPmonitor WEB GUI, where SQL injection is possible through the "api.php" file and the user parameter.

Recommendations For versions up to 24.61, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "api.php" file or the user parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-41408

Affected Products

Voipmonitor Web Gui

References · 4

• 🔥 https://gist.github.com/divinepwner/e51050e0d7df77ff1f1379583e8cf7db · Exploit
• https://voipmonitor.org/changelog-gui?major=5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41408 · Security Note