vBilling for FreeSWITCH suffers from multiple remote SQL injection vulnerabilities.
994b7109cb3e6f3b6c77edff6f1e8d54a0117e5090c812694dab17f3c64c0b94vBilling for FreeSWITCH.
http://blaszczakm.blogspot.com/2013/04/vbilling-freeswitch-sqli.html
Michal Blaszczak
1) SQL Injection
reset password any SIP account
file: controllers/customer.php
$sql2 = "UPDATE directory_params SET param_value = '".$new_password."'
WHERE directory_id = '".$record_id."' ";
2) SQL Injection
http://vbilling-host/customer/edit_customer
input Firstname: zuo’;-- (example)
Michał Błaszczak
http://blaszczakm.blogspot.com
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed