AsteriDex callboth.php Multiple Parameter CRLF Injection Arbitrary Command Execution

high Nessus Plugin ID 25674

Language:

Synopsis

The remote web server contains a PHP script that may allow execution of arbitrary commands.

Description

The remote host is running AsteriDex, a web-based dialer and address book for Asterisk.

The version of AsteriDex installed on the remote host fails to sanitize input to the 'IN' parameter of the 'callboth.php' script before passing it to the Asterisk Call Manager as part of the data stream of an authenticated session. Using a valid SIP address that answers when dialed, an unauthenticated attacker can leverage this issue to execute arbitrary code on the remote host subject to the privileges of the user id under which Asterisk runs.

Solution

Upgrade to AsteriDex version 3.1 or later.

Plugin Details

Severity: High

ID: 25674

File Name: asteridex_in_code_injection.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 7/6/2007

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/6/2007

Reference Information

CVE: CVE-2007-3621

BID: 24781

Detections

Analytics