Multiple vulnerabilities were identified in FreePBX Security-Reporting modules including an authenticated SQL Injection via ORDER BY clause in CDR Reports and an authenticated Local File Inclusion in the Dashboard module. These affect FreePBX versions 16 and 17 in specified versions and prior.
| Vendor | Product | Versions |
|---|---|---|
| sangoma technologies | freepbx | 16.0.50 and prior (Security-Reporting cdr), 17.0.11 and prior (Security-Reporting cdr), 16.0.22 and prior (Security-Reporting dashboard), 17.0.5 and prior (Security-Reporting dashboard) |
