CVE-2013-10043

A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/astium_sqli_upload.rb
https://www.exploit-db.com/exploits/23831
https://www.vulncheck.com/advisories/astium-voip-pbx-sqli-file-upload-rce

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en OAstium VoIP PBX astium-confweb-2.1-25399 y versiones anteriores, donde una validación de entrada incorrecta en el script logon.php permite a un atacante eludir la autenticación mediante inyección SQL. Una vez autenticado como administrador, el atacante puede cargar código PHP arbitrario a través del campo importcompany en import.php, lo que resulta en la ejecución remota de código. El payload malicioso se inyecta en /usr/local/astium/web/php/config.php y se ejecuta con privilegios de root al activar una recarga de la configuración mediante sudo /sbin/service astcfgd reload. Una explotación exitosa compromete completamente el sistema.

31 Jul 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-31 15:15

Updated : 2026-06-16 23:50

NVD link : CVE-2013-10043

Mitre link : CVE-2013-10043

CVE.ORG link : CVE-2013-10043

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2013-10043", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2013-10043", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-07-31T15:18:38.268321Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Astium", "modules": ["/usr/local/astium/web/php/config.php"], "product": "VoIP PBX", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "astium-confweb-2.1-25399 RPM"}], "defaultStatus": "unaffected"}]}], "published": "2025-07-31T15:15:34.313", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/astium_sqli_upload.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/23831", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/astium-voip-pbx-sqli-file-upload-rce", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise."}, {"lang": "es", "value": "Existe una vulnerabilidad en OAstium VoIP PBX astium-confweb-2.1-25399 y versiones anteriores, donde una validaci\u00f3n de entrada incorrecta en el script logon.php permite a un atacante eludir la autenticaci\u00f3n mediante inyecci\u00f3n SQL. Una vez autenticado como administrador, el atacante puede cargar c\u00f3digo PHP arbitrario a trav\u00e9s del campo importcompany en import.php, lo que resulta en la ejecuci\u00f3n remota de c\u00f3digo. El payload malicioso se inyecta en /usr/local/astium/web/php/config.php y se ejecuta con privilegios de root al activar una recarga de la configuraci\u00f3n mediante sudo /sbin/service astcfgd reload. Una explotaci\u00f3n exitosa compromete completamente el sistema."}], "lastModified": "2026-06-16T23:50:35.537", "sourceIdentifier": "disclosure@vulncheck.com"}