CVE-2018-15892

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.

Score

CVSS 3.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2019-06-20

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Disa (Freepbx)

References

• https://wiki.freepbx.org/display/FOP/2018-09-11+DISA+SQL+Injection
• https://www.freepbx.org/