CVE-2025-34099

VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password

CVSS 9.3 CRITICALEPSS 1.2%CWE-20 CWE-78

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

VICIdial Group · VICIdial

public PoCs found — 2

cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rbunverified cve_referencewww.exploit-db.com/exploits/42370unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb https://vulncheck.com/advisories/vicidial-unauth-command-injection https://www.exploit-db.com/exploits/42370 https://www.vicidial.org/VICIDIALmantis/view.php?id=1016