CVE-2019-11409

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

app / operator_panel / exec.php en el módulo del panel del operador en FreePBX 4.4.3 sufre una vulnerabilidad de inyección de comandos debido a la falta de validación de entrada que permite a los atacantes no administrativos autenticados ejecutar comandos en el host. Esto puede llevar además a la ejecución remota de código cuando se combina con una vulnerabilidad XSS también presente en el módulo del Panel del operador de FusionPBX