Elastix is prone to a php code injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary php code within the context of the affected webserver process. Elastix < 2.4 is vulnerable other versions may also be affected.

• http://packetstormsecurity.com/files/119253/elastix23-exec.txt
• http://www.elastix.org/

---

Updated on 2015-03-25