VICIDIAL is prone to a command-injection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

Ask the Vendor for an update.

In multiple locations, there are calls to passthru() that do not perform any filtering or sanitization on the input.

VICIDIAL 2.7RC1, 2.7 and 2.8-403a are vulnerable other versions may also be affected.

Send a crafted HTTP GET request which tries to execute the 'id' command.

• http://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/
• http://www.securityfocus.com/bid/63288
• http://www.vicidial.org/vicidial.php

---

Updated on 2015-03-25