Missedcall
Monthly
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.