[ad_1]
Crucial safety vulnerabilities have been uncovered in VoIPmonitor software program that, if efficiently exploited, might enable unauthenticated attackers to escalate privileges to the administrator stage and execute arbitrary instructions.
Following accountable disclosure by researchers from Kerbit, an Ethiopia-based penetration-testing and vulnerability analysis agency, on December 15, 2021, the problems had been addressed in model 24.97 of the WEB GUI shipped on January 11, 2022.
“[F]ix vital vulnerabilities – new SQL injects for unauthenticated customers permitting gaining admin privileges,” the maintainers of VoIPmonitor famous within the change log.
VoIPmonitor is an open-source community packet sniffer with business frontend for SIP RTP and RTCP VoIP protocols working on Linux, permitting customers to observe and troubleshoot high quality of SIP VoIP calls in addition to decode, play, and archive calls in a CDR database.
The three flaws recognized by Kerbit is under –
- CVE-2022-24259 (CVSS rating: 9.8) – An authentication bypass bug within the “cdr.php” part of the GUI that permits an unauthenticated attacker to raise privileges by way of a specifically crafted request.
- CVE-2022-24260 (CVSS rating: 9.8) – An SQL injection vulnerability that happens within the “api.php” and “utilities.php” parts of the GUI that permits attackers to escalate privileges to the administrator stage and retrieve delicate information.
- CVE-2022-24262 (CVSS rating: 7.8) – A distant command execution by way of the GUI’s configuration restore performance as a consequence of a lacking test for archive file codecs, permitting a nasty actor to execute arbitrary instructions by way of a crafted file.
“The principle purpose that the one bug right here is the truth that we’re allowed to add any file extension and that we will attain the uploaded recordsdata to get them to execute,” Kerbit researcher Daniel Eshetu, who found the issues, stated in a write-up.
[ad_2]
