2018-09-11 DISA SQL Injection
- Nathaniel Halbrooks
SEC-2018-004
Overview:
An SQL Injection vulnerability exists in FreePBX 13 and 14 in the Disa module listed under "Vulnerable software and versions" section
Note: Disa 15 is not affected
Discovered By:
DcLabs Security Research Group
Ewerson Guimarães (Crash) - Dclabs <crash(at)dclabs(dot)com(dot)br>
Impact:
CVSS 3 Details:
CVSS Base Score: 3.9
Impact Subscore: 3.4
Exploitability Subscore: 0.5
CVSS Temporal Score: 3.5
CVSS Environmental Score: 2.6
Modified Impact Subscore: 1.9
Overall CVSS Score: 2.6
Vulnerable software and versions:
The versions listed below (or less than)
< disa v13.0.6.2
The following versions of fixes:
>= disa v13.0.6.2
Related Information
Official Bug ticket: FREEPBX-18161 - Multiple XSS/SQL Vulnerabilities CLOSED
Further Details:
The user has to be previously authenticated as a FreePBX administrator and be tricked into clicking an external link that would generate the SQL injection.
SQL injections can be used to modify the database against a user's will.
The Sangoma and FreePBX team has deemed this a minor security issue. We strongly encourage all users of FreePBX 13and 14 to upgrade to the latest disa version. This can be done from the Module Admin GUI or fwconsole. For more information on using Module Admin, please see https://sangomakb.atlassian.net/wiki/spaces/PG/pages/20023939/Module+Admin+User+Guide .
Sangoma takes security seriously and request that any future FreePBX security issue be reported at security@freepbx.org.