HTTP: FusionPBX Operator Panel exec.php Command Injection
This signature detects attempts to exploit a known vulnerability against FusionPBX Web Application. A successful attack can lead to command injection and arbitrary code execution.
Extended Description
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
Affected Products
Fusionpbx fusionpbx
References
CVE: CVE-2019-11409
Short Name
HTTP:CTS:FUSIONPBX-EXECPHP-CI
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2019-11409 Command FusionPBX Injection Operator Panel exec.php
Release Date
01/16/2020
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3337
False Positive
Unknown
Vendors
Fusionpbx
CVSS Score
6.5