Program: CWE-94
Project: CVE-2014-7235
Buggy source:
<module>
	<rawname>fw_ari</rawname>
	<modtype>framework</modtype>
	<repo>standard</repo>
	<name>FreePBX ARI Framework</name>
	<version>2.11.1.4</version>
	<publisher>Schmooze Com Inc</publisher>
	<license>GPLv3+</license>
	<licenselink>http://www.gnu.org/licenses/gpl-3.0.txt</licenselink>
	<changelog>
		*2.11.1.4* Force removal of User Panel Tab
		*2.11.1.3* Delete user panel tab because it comes from this module now
		*2.11.1.2* Resolve issue of user panel tab removement
		*2.11.1.1* Tweaks
		*2.11.1.0* Allow uninstall and fix for 12 if needed or wanted
		*2.11.0.7* Include license file
		*2.11.0.6* Class conflicts with User Manager and BMO
		*2.11.0.5* #7107 ignore semicoloned lines
		*2.11.0.4* Add back in .htaccess file
		*2.11.0.3* #6165
		*2.11.0.2* Packaging of ver 2.11.0.2
		*2.11.0.0* Packaging of ver 2.11.0.0
		*2.11.0.0* bump version
		*2.10.0.5* #5885
		*2.10.0.4* re #5743 -
		*2.10.0.3* #5729 Possible Authenticated user RCE Security Vulnerability
		*2.10.0.2* #5711 RCE and XSS Security Vulnerability
		*2.10.0.1* #5492, #5565
		*2.10.0.0* bump to final
		*2.10.0rc1.3* #5585 SECURITY ISSUE introduced in 2.10.0rc1.2 previous version
		*2.10.0rc1.2* revert changes from #4909
		*2.10.0rc1.1* #5545, #4909, #5565
		*2.10.0rc1.0* misc tweaks, release candidate
		*2.10.0beta1.2* #5476, adds .htaccess for better security
		*2.10.0beta1.1* #5342, #5375, undefined vars, call recording changes
		*2.10.0beta1.0* beta1 release, see svn log
		*2.9.0.6* #5102
		*2.9.0.5* #5034
		*2.9.0.4* #4945
		*2.9.0.3* #4001, #4884, #4404
		*2.9.0.2* #4841, #4861
		*2.9.0.1* #4501
		*2.9.0.0* #4509, #4134, #4501, #4427, #4332, #4652, #4621, #4401, #4482, #4566
	</changelog>
	<description>
		This module provides a facility to install bug fixes to the ARI code that is not otherwise housed in a module, it used to be part of framework but has been removed to isolate ARI from Framework updates.
	</description>
	<supported>
		<version>2.10</version>
	</supported>
	<category>Admin</category>i
		<menuitems>
		<fw_ari
			category="User Panel"
			href="/recordings"
			target="ari"
			access="all"
			requires_auth="false"
		>User Panel</fw_ari>
	</menuitems>
	<location>release/2.11/fw_ari-2.11.0.0.tgz</location>
	<md5sum>751792b204e454cb74ff42e95cdc2c30</md5sum>
</module>


Fixed version (ground truth):
<module>
	<rawname>fw_ari</rawname>
	<modtype>framework</modtype>
	<repo>standard</repo>
	<name>FreePBX ARI Framework</name>
	<version>2.11.1.5</version>
	<publisher>Schmooze Com Inc</publisher>
	<license>GPLv3+</license>
	<licenselink>http://www.gnu.org/licenses/gpl-3.0.txt</licenselink>
	<changelog>
		*2.11.1.5* FREEPBX-8070 SECURITY ISSUE Exec shell on a host using bug in Asterisk Recording Interface index.php
		*2.11.1.4* Force removal of User Panel Tab
		*2.11.1.3* Delete user panel tab because it comes from this module now
		*2.11.1.2* Resolve issue of user panel tab removement
		*2.11.1.1* Tweaks
		*2.11.1.0* Allow uninstall and fix for 12 if needed or wanted
		*2.11.0.7* Include license file
		*2.11.0.6* Class conflicts with User Manager and BMO
		*2.11.0.5* #7107 ignore semicoloned lines
		*2.11.0.4* Add back in .htaccess file
		*2.11.0.3* #6165
		*2.11.0.2* Packaging of ver 2.11.0.2
		*2.11.0.0* Packaging of ver 2.11.0.0
		*2.11.0.0* bump version
		*2.10.0.5* #5885
		*2.10.0.4* re #5743 -
		*2.10.0.3* #5729 Possible Authenticated user RCE Security Vulnerability
		*2.10.0.2* #5711 RCE and XSS Security Vulnerability
		*2.10.0.1* #5492, #5565
		*2.10.0.0* bump to final
		*2.10.0rc1.3* #5585 SECURITY ISSUE introduced in 2.10.0rc1.2 previous version
		*2.10.0rc1.2* revert changes from #4909
		*2.10.0rc1.1* #5545, #4909, #5565
		*2.10.0rc1.0* misc tweaks, release candidate
		*2.10.0beta1.2* #5476, adds .htaccess for better security
		*2.10.0beta1.1* #5342, #5375, undefined vars, call recording changes
		*2.10.0beta1.0* beta1 release, see svn log
		*2.9.0.6* #5102
		*2.9.0.5* #5034
		*2.9.0.4* #4945
		*2.9.0.3* #4001, #4884, #4404
		*2.9.0.2* #4841, #4861
		*2.9.0.1* #4501
		*2.9.0.0* #4509, #4134, #4501, #4427, #4332, #4652, #4621, #4401, #4482, #4566
	</changelog>
	<description>
		This module provides a facility to install bug fixes to the ARI code that is not otherwise housed in a module, it used to be part of framework but has been removed to isolate ARI from Framework updates.
	</description>
	<supported>
		<version>2.10</version>
	</supported>
	<category>Admin</category>i
		<menuitems>
		<fw_ari
			category="User Panel"
			href="/recordings"
			target="ari"
			access="all"
			requires_auth="false"
		>User Panel</fw_ari>
	</menuitems>
	<location>release/2.11/fw_ari-2.11.0.0.tgz</location>
	<md5sum>751792b204e454cb74ff42e95cdc2c30</md5sum>
</module>