Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2014-1903

Quick assessment

Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX中的admin/libraries/view.functions.php脚本中存在安全漏洞，该漏洞源于程序没有正确限制函数集对API处理器的访问。远程攻击者可通过向admin/config.php脚本传递‘function’和‘args’参数，利用该漏洞执行任意PHP代码。以下版本受到影响：FreePBX 2.9，

AI Predicted 9.8 Difficulty: Trivial EPSS 52.78% · P99
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2014-1903

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
FreePBX admin/libraries/view.functions.php 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX中的admin/libraries/view.functions.php脚本中存在安全漏洞，该漏洞源于程序没有正确限制函数集对API处理器的访问。远程攻击者可通过向admin/config.php脚本传递‘function’和‘args’参数，利用该漏洞执行任意PHP代码。以下版本受到影响：FreePBX 2.9，
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2014-1903

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2014-1903

请登录查看更多情报信息。

Vendor Advisories for CVE-2014-1903 (2)

Exploits & Public PoCs for CVE-2014-1903 (2)

Mailing List Discussions for CVE-2014-1903 (2)

Other References for CVE-2014-1903 (6)

Same Patch Batch · n/a · 2014-02-18 · 12 CVEs total

CVE-2013-6396 python-swiftclient SSL证书验证安全绕过漏洞
CVE-2014-1943 Fine Free file 安全漏洞
CVE-2014-2019 Apple iOS iCloud 权限许可和访问控制漏洞
CVE-2013-7226 PHP‘gdImageCrop’函数整数溢出漏洞
CVE-2013-7327 PHP‘gdImageCrop’函数输入验证漏洞
CVE-2013-7328 PHP‘gdImageCrop’函数整数符号错误漏洞
CVE-2014-1861 Jetro COCKPIT Secure Browsing 输入验证漏洞
CVE-2014-2020 PHP‘ext/gd/gd.c’安全漏洞
CVE-2014-0625 EMC RSA BSAFE JSAFE和JSSE API 拒绝服务漏洞
CVE-2014-0626 EMC RSA BSAFE JSAFE和JSSE API 加密问题漏洞
CVE-2014-0627 EMC RSA BSAFE SSLEngine API 加密问题漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2014-1903

No comments yet

Leave a comment