Test ID:	1.3.6.1.4.1.25623.1.0.100890
Category:	Web application abuses
Title:	FreePBX <= 2.8.0 Arbitrary File Upload Vulnerability
Summary:	FreePBX is prone to an arbitrary file upload vulnerability; because it fails to properly sanitize user-supplied input.
Description:	Summary: FreePBX is prone to an arbitrary file upload vulnerability because it fails to properly sanitize user-supplied input. Vulnerability Impact: An attacker can leverage this issue to upload arbitrary files to the affected computer, this can result in arbitrary code execution within the context of the webserver. Affected Software/OS: FreePBX version 2.8.0 and probably prior. Solution: Please see the referenced vendor advisory for a solution. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3490 BugTraq ID: 43454 http://www.securityfocus.com/bid/43454 Bugtraq: 20100923 TWSL2010-005: FreePBX recordings interface allows remote code execution (Google Search) http://www.securityfocus.com/archive/1/513947/100/0/threaded http://www.exploit-db.com/exploits/15098 http://www.freepbx.org/trac/ticket/4553 https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.