EUVD-2025-21037
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Tags
Description
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
Analysis
VICIdial call center software versions 2.9 RC1 through 2.13 RC1 contain an unauthenticated command injection in vicidial_sales_viewer.php when password encryption is enabled. The HTTP Basic Authentication password is passed directly to OS commands without sanitization, enabling remote code execution on the call center server.
Technical Context
When password encryption is enabled (non-default), the vicidial_sales_viewer.php script passes the HTTP Basic Authentication password to an OS command for decryption. Shell metacharacters in the password field allow command injection. The attack requires password encryption to be enabled, which is a common hardening step.
Affected Products
['VICIdial 2.9 RC1 through 2.13 RC1 (with password encryption enabled)']
Remediation
Update VICIdial to the latest version. If encryption is needed, implement secure password handling without shell execution. Restrict web interface access to trusted networks.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today