FreePBX Logfiles Module Authenticated SQL Injection Vulnerability

In the FreePBX logfiles module, prior to versions 16.0.10 and 17.0.5, several authenticated SQL injection vulnerabilities were identified. These vulnerabilities arise from inadequate input sanitization in specific module commands, allowing user-controlled data to be directly inserted into SQL queries. An authenticated user could exploit this to view or manipulate database information.

Impact

Exploitation of these vulnerabilities allows for authenticated SQL injection, enabling attackers to execute arbitrary SQL commands. This could lead to unauthorized data access, data manipulation, or potentially executing administrative operations on the database.

Remediation

Users are advised to update the logfiles module to the latest version. Additionally, ensure that only authorized users have access to the FreePBX Administrator Control Panel, and consider using the FreePBX Firewall module to deny access from hostile networks.