FreePBX is prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

Updates are available.

admin/libraries/view.functions.php does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.

FreePBX versions 2.9, 2.10, 2.11, and 12 are vulnerable.

Try to execute a command with a sprecial crafted HTTP GET request.

• http://freepbx.org
• http://www.securityfocus.com/bid/65509

---

Updated on 2015-03-25