AsteriDex CallBoth.PHP Remote Command Execution Vulnerability

Bugtraq ID:	24781
Class:	Input Validation Error
CVE:	CVE-2007-3621
Remote:	Yes
Local:	No
Published:	Jul 05 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Carl Livitt is credited with the discovery of this issue.
Vulnerable:	AsteriDex AsteriDex 3.0
Not Vulnerable:	AsteriDex AsteriDex 3.1

AsteriDex CallBoth.PHP Remote Command Execution Vulnerability

AsteriDex is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to execute arbitrary commands with the privileges of the affected application. Successful attacks may facilitate a compromise of the application and underlying webserver; other attacks are also possible.

AsteriDex CallBoth.PHP Remote Command Execution Vulnerability

An attacker can exploit this issue via a browser.

The following proof of concept is available:

• /data/vulnerabilities/exploits/24781

AsteriDex CallBoth.PHP Remote Command Execution Vulnerability

Solution:
The vendor has released fixes to address this issue. Please see the references for more information.


AsteriDex AsteriDex 3.0

• AsteriDex asteridex31.zip
  http://nerdvittles.com/trixbox11/asteridex31.zip

AsteriDex CallBoth.PHP Remote Command Execution Vulnerability

References:

• AsteriDex (Asterisk / Trixbox) remote code execution (Carl Livitt)
  
• AsteriDex Homepage (AsteriDex)