Description
In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.
Unscored
CVE-2019-16985
EUVD-2019-7462GHSA-952f-77pp-hgm6
In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 …
Published Oct 21, 2019 · Updated Aug 5, 2024 · Assigned by mitre