Mil1200

The `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel pgsql` and `cel tds` may permit arbitrary SQL execution. This occurs when untrusted data is set in the CEL `eventtype` column via the `CELGenUserEvent()` dialplan application. The issue requires the `cel pgsql` or `cel tds` backend to be loaded and configured, and the administrator to call `CELGenUserEvent()` in the dialplan without validating the data passed to the application.

An authenticated attacker can trigger a heap buffer overflow via an out-of-bounds write in the `Codec2` decoder. This occurs due to a `floor/ceil sample-count mismatch`. To exploit this, the `codec codec2` module must be loaded and `Codec2` must be configured on the target endpoint. The attacker needs to pass SIP authentication using a username and password or `source IP address matching`, establish a call using `Codec2`, and transmit specially crafted `Codec2` audio packets.

An unbounded `memcpy` of `OGG/Speex` packet data within the `format ogg speex` function can lead to a heap buffer overflow, resulting in a system crash. This occurs when the software reads a file containing corrupted Speex audio. Exploitation requires the attacker to create a malicious file and ensure it is available to the system, either through elevated privileges or by deceiving an administrator, and the system must be configured to play that file.

An authenticated attacker can trigger a stack buffer overflow in the `res xmpp` module during the handling of the `XMPP namespace prefix` using specially crafted packets. This occurs when the `res xmpp` module is loaded, an XMPP connection is configured in `xmpp.conf`, and the attacker possesses an XMPP account on the same or a federated server.

An unauthenticated attacker can use reflected cross-site scripting (XSS) within phone provisioning HTTP error pages to steal an authorized user's `AMI session cookie` and impersonate them. This occurs when the `res phoneprov` module is enabled. Successful exploitation requires the Asterisk HTTP web server, the Asterisk Manager Interface (AMI), and AMI access via HTTP to be enabled. Additionally, the attacker must have connectivity to the HTTP server and trick an authorized user into clicking a malicious link.

The LDAP realtime driver `res config ldap` allows LDAP filter injection via the `SIP username`. This enables an unauthenticated attacker to execute arbitrary LDAP queries and disclose information by sending specially crafted SIP packets. This issue occurs only when the `res config ldap` module is loaded and configured to access an LDAP server.

The OAuth2 implementation in the api module fails to properly validate client credentials during token issuance. Specifically, the `validateClient()` function in ClientRepository.php unconditionally returns true. This allows an attacker who knows a valid `client id` to obtain OAuth2 access tokens without providing the required `client secret`.

The CDR Reports module page allows SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs through the `order` and `sort` POST parameters. Exploitation requires authentication with a FreePBX Administration Control Panel account that has access to the CDR section, although full administrator privileges are not necessary.

The Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without proper path sanitization. By using path traversal sequences such as ../ in the `rawname` parameter, an attacker can include arbitrary .class.php files from the filesystem. The PHP code within the included file is executed before a class instantiation error occurs.