FreePBX TTS Module SQL Injection Vulnerability Allowing Code Execution

A SQL injection vulnerability has been identified in the FreePBX Text to Speech (TTS) module, affecting FreePBX versions prior to 16.0.5 and 17.0.5. This vulnerability allows authenticated users with administrative access to the Administrator Control Panel (ACP) to manipulate SQL queries. Exploitation of this vulnerability could lead to unauthorized access to sensitive database information and the execution of code on the system as the 'asterisk' user, with potential escalation to 'root' privileges.

Impact

Exploitation of this vulnerability could result in unauthorized database access, execution of arbitrary code on the system as the 'asterisk' user, and escalation of privileges to 'root'.

Remediation

Users are advised to update the FreePBX TTS module to version 16.0.5 or 17.0.5.