CVE-2013-4467
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow...
- Published
- Mar 11, 2014
- Updated
- Aug 6, 2024
- Assigning CNA
- redhat
- Evidence observed
- Nov 8, 2013
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:S/C:P/I:P/A:PModerate · next 30 days
- Percentile
- 98.3%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors. NOTE: some of these details are obtained from third party information.
Sources
modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Unix($.exploit_unix/webapp/vicidial_manager_send_cmd_exec.platform)
- verification: check_declared($.exploit_unix/webapp/vicidial_manager_send_cmd_exec.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.