VULNERABILITIES / FIXES - March 26, 2012
by Carol~ - 3/26/12 9:50 AM
FreePBX Multiple Cross-Site Scripting Vulnerabilities
Release Date : 2012-03-26
Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch
Software: FreePBX 2.x
Multiple vulnerabilities have been discovered in FreePBX, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "context" parameter in panel/index_amp.php and panel/dhtml/index.php, "clid" and "clidname" parameters in panel/flash/mypage.php, and via the URL to admin/views/freepbx_reload.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 2.9.0. Prior versions may also be affected.
Update to version 2.10.0.
Provided and/or discovered by: