Nate

3 exploits Active since Oct 2019
CVE-2019-16980 WRITEUP HIGH WRITEUP
FusionPBX < 4.5.7 - SQL Injection via call_broadcast_edit.php id Parameter
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
CVSS 8.8
CVE-2019-16990 WRITEUP MEDIUM WRITEUP
FusionPBX < 4.5.7 - Path Traversal via Unsanitized File Parameter in music_on_hold.php
In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it.
CVSS 6.5
CVE-2019-19366 WRITEUP MEDIUM WRITEUP
FusionPBX 4.4.1 - Cross-Site Scripting via Redirect Parameter in xml_cdr_search.php
A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
CVSS 6.1