FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
| Vendor | Product | Versions |
|---|---|---|
| freepbx | api | 0 |
Updated severity to CRITICAL and corrected exploit availability to false.
Initial creation
