CVE-2014-1903
NONE EPSS 98.8%
Published Feb 18, 201412y ago · Modified Jun 17, 20262w ago
Published Feb 18, 2014 12y ago
Last Modified Jun 17, 2026 2w ago
Description
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Threat Intelligence
EPSS Exploit Probability
98.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-264
Affected Products 4
References 12
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html
- code.freepbx.org http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03
- code.freepbx.org http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429
- issues.freepbx.org http://issues.freepbx.org/browse/FREEPBX-7117
- issues.freepbx.org http://issues.freepbx.org/browse/FREEPBX-7123
- osvdb.org http://osvdb.org/103240
- packetstormsecurity.com http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html
- packetstormsecurity.com http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html
- freepbx.org http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice
- securityfocus.com http://www.securityfocus.com/archive/1/531040/100/0/threaded
- github.com https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.