CVE-2015-1875

Elastix < 2.5.0 - SQL Injection via transactionID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-1875. PoCs published by Ahmed Aboul-Ela.

AI-analyzed exploit summary The exploit details a blind SQL injection vulnerability in Elastix v2.x due to unsanitized input in the 'transactionID' parameter. The PoC demonstrates the vulnerability using a time-based SQL injection technique.

Description

SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter.

Exploits (1)

exploitdb WRITEUP
by Ahmed Aboul-Ela · textwebappsphp
https://www.exploit-db.com/exploits/36305

The exploit details a blind SQL injection vulnerability in Elastix v2.x due to unsanitized input in the 'transactionID' parameter. The PoC demonstrates the vulnerability using a time-based SQL injection technique.

Classification
Writeup 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Elastix v2.5.0 and prior
No auth needed
Prerequisites: Access to the vulnerable endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/36305/

Scores

EPSS 0.0127
EPSS Percentile 66.1%

Details

CWE
CWE-89
Status published
Products (1)
palosanto/elastix < 2.5.0
Published Mar 11, 2015
Tracked Since Feb 18, 2026