Trixbox Security Vulnerabilities

vendor:

Trixbox

by:

SecurityFocus

7,5

CVSS

HIGH

SQL-injection, Cross-site Scripting, Local File-Include, Remote Code-Execution

89, 79, 94, 78

CWE

Product Name: Trixbox

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

Trixbox Security Vulnerabilities

Trixbox is prone to multiple security vulnerabilities, including SQL-injection, cross-site scripting, local file-include, and remote code-execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, exploit latent vulnerabilities in the underlying database or perform certain unauthorized actions and gain access to the affected application.

Mitigation:

Users should apply the latest available updates to mitigate the risk of exploitation.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/68720/info

Trixbox is prone to the following security vulnerabilities:

1. An SQL-injection vulnerability
2. A cross-site scripting vulnerability
3. Multiple local file-include vulnerabilities
4. A remote code-execution vulnerability

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, exploit latent vulnerabilities in the underlying database or perform certain unauthorized actions and gain access to the affected application. 

Http://www.example.com/maint/modules/endpointcfg/endpoint_generic.php?action=Submit&mac=1' and 1=2 union select 1,2,3,4,5,6-- -