Description
admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.
References
- 20070421 freePBX 2.2.x's Music-on-hold Remote Code Execution Injection mailing-list
- 35316 vdb-entry
- 2652 third-party-advisory
- 24935 third-party-advisory
- ADV-2007-1535 vdb-entry