CVE-2019-16980: SQL Injection
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\callbroadcast\callbroadcastedit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·02:10 PM
Data Sourced
via MITRE·02:10 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16980?
CVE-2019-16980 has a medium severity level due to its potential for SQL injection vulnerabilities.
2
How do I fix CVE-2019-16980?
To fix CVE-2019-16980, it is recommended to upgrade FusionPBX to version 4.5.8 or later where the vulnerability has been addressed.
3
What is the impact of CVE-2019-16980 on my system?
The impact of CVE-2019-16980 allows an attacker to execute arbitrary SQL commands on the database, leading to data compromise.
4
Which versions of FusionPBX are affected by CVE-2019-16980?
CVE-2019-16980 affects FusionPBX versions up to and including 4.5.7.
5
Is CVE-2019-16980 easy to exploit?
Yes, CVE-2019-16980 can be easily exploited by sending specially crafted requests due to the lack of input sanitation.