CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: ** disputed ** freepbx 10.13.66-32bit and 14.0.1.24 (sng7-pbx-64bit-1712-2) allow post-authentication sql injection via the order parameter. note: the vendor disputes this issue because it is intentional that a user can "directly modify sql tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors."
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-01-29
Last Modified Date: 2019-04-16