CVE-2013-4467: Vicidial

Medium severity, CVSS 6.5. EPSS: 31.4% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors. NOTE: some of these details are obtained from third party information.

Affected products

• Vicidial Vicidial: up to and including 2.7; version 2.7 only; version 2.8 only

Published 2014-03-11. Last modified 2026-06-16.