CVE-2014-1903

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

52.78%

Published

Feb 18, 2014

Modified

Apr 28, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBFreePBX 2.11.0 - Remote Command Execution Exploit-DBFreePBX - 'config.php' Remote Code Execution (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.

Weaknesses (CWE)

CWE-264

Affected Products (4)

freepbx · freepbxvulnerable

sangoma · freepbxvulnerable

References (20)

http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html

http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html

http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03

http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429

http://issues.freepbx.org/browse/FREEPBX-7117

Vendor Advisory

http://issues.freepbx.org/browse/FREEPBX-7123

Vendor Advisory

http://osvdb.org/103240

KEV Catalog EPSS Scores Vendors All CVEs