FreePBX is prone to an arbitrary file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue to upload arbitrary files to the affected computer this can result in arbitrary code execution within the context of the webserver. FreePBX 2.8.0 is vulnerable other versions may also be affected.

Updates are available please see the references for more information.

• http://freepbx.org
• http://www.freepbx.org/trac/ticket/4553
• http://www.securityfocus.com/archive/1/513947
• https://www.securityfocus.com/bid/43454
• https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt

---

Updated on 2015-03-25