RCE in Incrediblepbx Incredible Pbx 11

CVE-2014-9001

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) APPTMIN, (2) APPTHR, (3) APPTDA, (4) APPTMO, (5) APPTYR, or (6) APPTPHONE parameters.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.028 (85.0th percentile) — read the EPSS interpretation.

Affected products

Incrediblepbx Incredible_pbx_11 — versions 2.0.6.5.0
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)