CVE-2019-11409
60Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 87%
de la publicación al arma156 días
Publicada en NVD17 jun
1ª PoC+156d
metasploit6 jun
probabilidad de explotación
87%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
3 exploit(s) público(s)
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47697cve_referencepacketstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlhttps://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlhttps://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611