admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha2…

published 2014-02-18 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-1965

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 51.8%; EPSS 51.8% chance of exploitation in 30 days, percentile 98%
public exploits: 3; Metasploit, Exploit-DB

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.

Timeline

2014-02-18 Published
2014-03-12 First public exploit (EDB-32214)

Exploit prediction

51.81% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/unix/webapp/freepbx_config_exec FreePBX config.php Remote Code Execution metasploit exploit, excellent rank, 2014-03-21
EDB-32512 FreePBX - 'config.php' Remote Code Execution (Metasploit) remote, 2014-03-25
EDB-32214 FreePBX 2.11.0 - Remote Command Execution webapps, 2014-03-12

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

Sources

CVE List CVE-2014-1903
NVD CVE-2014-1903

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary