Description
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
VICIdial Group VICIdial
Default version status: unaffected
2.9 RC1 to ≤ 2.13 RC1affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb ↗
- https://vulncheck.com/advisories/vicidial-unauth-command-injection ↗
- https://www.exploit-db.com/exploits/42370 ↗
- https://www.vicidial.org/VICIDIALmantis/view.php?id=1016 ↗