CVE-2010-3490

EPSS 9.6%

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/moayadalmalat/CVE-2010-3490★ 1 cve_referencewww.exploit-db.com/exploits/15098unverified exploitdbwww.exploit-db.com/exploits/15098unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt http://www.exploit-db.com/exploits/15098 http://www.freepbx.org/trac/ticket/4553 http://www.securityfocus.com/archive/1/513947/100/0/threaded http://www.securityfocus.com/bid/43454