CVE-2007-6170: SQL Injection
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdrpgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6170?
CVE-2007-6170 is a high severity vulnerability that allows remote authenticated users to execute arbitrary SQL commands.
How do I fix CVE-2007-6170?
To fix CVE-2007-6170, upgrade Asterisk to version 1.4.15 or later, 1.2.25 or later, B.2.3.4 or later, or C.1.0-beta6 or later.
Who is affected by CVE-2007-6170?
The vulnerability affects remote authenticated users of Asterisk versions prior to 1.4.15, 1.2.25, B.2.3.4, and C.1.0-beta6.
What type of vulnerability is CVE-2007-6170?
CVE-2007-6170 is classified as an SQL injection vulnerability.
Can CVE-2007-6170 lead to data compromise?
Yes, CVE-2007-6170 can lead to unauthorized access and compromise sensitive data due to arbitrary SQL command execution.