FreePBX 16 Authenticated Remote Code Execution via API Module

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

FreePBX 操作系统命令注入漏洞

FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX 16版本存在操作系统命令注入漏洞，该漏洞源于API模块中存在远程代码执行，可能导致建立远程shell访问。

N/A

N/A