CVE-2018-15892: SQL Injection
FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-15892?
CVE-2018-15892 refers to a SQL Injection vulnerability in FreePBX 13 and 14 that can be exploited via the hangup variable on the /admin/config.php?display=disa&view=form page.
How does the SQL Injection vulnerability in FreePBX 13 and 14 occur?
The SQL Injection vulnerability occurs in the DISA module of FreePBX 13 and 14, specifically through the hangup variable on the /admin/config.php?display=disa&view=form page.
What is the severity of CVE-2018-15892?
CVE-2018-15892 has a severity keyword of 'medium' and a severity value of 4.3 out of 10.
How can the SQL Injection vulnerability in FreePBX 13 and 14 be fixed?
To fix the SQL Injection vulnerability, it is recommended to upgrade FreePBX to version 14.0.10.3 or higher.
Where can I find more information about CVE-2018-15892?
More information about CVE-2018-15892 can be found on the FreePBX wiki (https://wiki.freepbx.org/display/FOP/2018-09-11+DISA+SQL+Injection) and the FreePBX website (https://www.freepbx.org/).