| Package | Affected versions | Patched versions |
|---|---|---|
| api | < 17.0.8 | 17.0.8 |
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free