VYPR
← All advisories
High severity7.2OSV Advisory· Published Jan 29, 2018· Updated Jun 17, 2026

CVE-2018-6393

CVE-2018-6393

Description

FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Freepbx/FrameworkOSV
    Range: release/12.0.0.0alpha1.0, release/12.0.1alpha1, release/12.0.1alpha10, …
  • Freepbx/Freepbx3 versions
    cpe:2.3:a:sangoma:freepbx:10.13.66:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sangoma:freepbx:10.13.66:*:*:*:*:*:*:*
    • cpe:2.3:a:sangoma:freepbx:14.0.1.24:*:*:*:*:*:*:*
    • (no CPE)range: >=10.13.66, <=14.0.1.24

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.