PT-2022-7110 · Sangoma · Freepbx

Published 2022-12-25 · Updated 2024-05-17 · CVE-2020-36630

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreePBX cdr versions 14.0 through 14.0.5.20

Description The issue is related to the ajaxHandler function in the ucp/Cdr.class.php file of the FreePBX web interface, which fails to protect against SQL query structure attacks. This can allow a remote attacker to execute arbitrary SQL commands by manipulating the limit/offset argument, leading to SQL injection.

Recommendations For FreePBX cdr versions 14.0 through 14.0.5.20, upgrade to version 14.0.5.21 to address this issue. As a temporary workaround, consider restricting access to the ajaxHandler function in the ucp/Cdr.class.php file until the upgrade is applied. Avoid using the limit/offset argument in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07593

CVE-2020-36630

Affected Products

Freepbx

References · 9

• https://github.com/FreePBX/cdr/commit/f1a9eea2dfff30fb99d825bac194a676a82b9ec8 · Patch
• https://github.com/FreePBX/cdr/releases/tag/release%2F14.0.5.21 · Patch
• https://bdu.fstec.ru/vul/2023-07593 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36630 · Security Note
• https://vuldb.com/?id.216771 · Note
• https://t.me/cibsecurity/55322 · Telegram Post
• https://t.me/cvenotify/40664 · Telegram Post
• https://vuldb.com/?ctiid.216771 · Note