CVE-2019-11409: OS Command Injection
app/operatorpanel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-11409?
CVE-2019-11409 is a command injection vulnerability in the Operator Panel module in FusionPBX 4.4.3.
How severe is CVE-2019-11409?
CVE-2019-11409 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2019-11409?
FusionPBX version 4.4.3 is affected by CVE-2019-11409.
How can an attacker exploit CVE-2019-11409?
Authenticated non-administrative attackers can exploit CVE-2019-11409 to execute commands on the host, potentially leading to remote code execution.
Are there any references for further information on CVE-2019-11409?
Yes, you can find more information on CVE-2019-11409 in the following references: [Reference 1](http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html), [Reference 2](http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.html), [Reference 3](https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html).