QwikSec

Security Database

CVE

CWE

Training

CVE-2014-7235

Published: Oct 7, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://packetstormsecurity.com/files/128516/FreePBX-Authentication-Bypass-Account-Creation.html

x_refsource_MISC

third-party-advisory

x_refsource_SECUNIA

https://github.com/FreePBX/fw_ari/commit/f294b4580ce725ca3c5e692d86e63d40cef4d836

x_refsource_CONFIRM

http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versions-cve-2014-7235/24536

x_refsource_CONFIRM

freepbx-ariframework-code-exec(96790)

vdb-entry

x_refsource_XF

exploit

x_refsource_EXPLOIT-DB

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.