Summary
A critical SQL injection vulnerability in the FreePBX missedcall module allows an unauthenticated caller to influence database queries through a crafted SIP From header.
When a monitored extension goes unanswered, the attacker-controlled Caller ID name may be inserted into the missed-call log without safe parameter handling, potentially enabling database corruption and unauthorized administrator access.
A critical SQL injection vulnerability in the FreePBX missedcall module allows an unauthenticated caller to influence database queries through a crafted SIP From header.
When a monitored extension goes unanswered, the attacker-controlled Caller ID name may be inserted into the missed-call log without safe parameter handling, potentially enabling database corruption and unauthorized administrator access.
Affected context
The vulnerability occurs in FreePBX deployments using the affected missedcall module and handling inbound SIP calls for monitored extensions. It becomes risky when Caller ID data from SIP From headers reaches the missed-call logging query without escaping or bound parameters, particularly when an unanswered call triggers missed-call processing.
The vulnerability occurs in FreePBX deployments using the affected missedcall module and handling inbound SIP calls for monitored extensions. It becomes risky when Caller ID data from SIP From headers reaches the missed-call logging query without escaping or bound parameters, particularly when an unanswered call triggers missed-call processing.
Exploit preconditions
- Attack surface: Inbound SIP calling and missed-call notification processing
- Required access: No prior authentication is generally required
- Trigger point: An inbound call to a monitored extension that is not answered
- Attacker influence: Control of the Caller ID name within a crafted SIP From header
- Why exploitation is possible: Untrusted Caller ID data is incorporated into an SQL INSERT without parameterized query handling
- Attack surface: Inbound SIP calling and missed-call notification processing
- Required access: No prior authentication is generally required
- Trigger point: An inbound call to a monitored extension that is not answered
- Attacker influence: Control of the Caller ID name within a crafted SIP From header
- Why exploitation is possible: Untrusted Caller ID data is incorporated into an SQL INSERT without parameterized query handling
Why this happens
The underlying bug is an SQL injection flaw caused by concatenating or otherwise directly embedding attacker-controlled Caller ID data into a database statement.
Because the value is not safely escaped and is not supplied through a bound parameter, SQL syntax from the SIP header may be interpreted as part of the query rather than as data. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
The underlying bug is an SQL injection flaw caused by concatenating or otherwise directly embedding attacker-controlled Caller ID data into a database statement.
Because the value is not safely escaped and is not supplied through a bound parameter, SQL syntax from the SIP header may be interpreted as part of the query rather than as data. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Potential impact
- An unauthenticated attacker may alter or corrupt missed-call records
- Database contents may be exposed, modified, or deleted
- FreePBX administrator account records could be changed
- Attackers could obtain unauthorized administrative access
- Compromised administrative access could enable further telephony or server abuse
- An unauthenticated attacker may alter or corrupt missed-call records
- Database contents may be exposed, modified, or deleted
- FreePBX administrator account records could be changed
- Attackers could obtain unauthorized administrative access
- Compromised administrative access could enable further telephony or server abuse
General mitigation guidance
Mitigation should focus on removing SQL interpretation from untrusted SIP metadata and reducing the privileges available to the affected database operation.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database write
- Treat Caller ID and other SIP-derived metadata as untrusted input
- Apply schema-aware validation and length limits appropriate to Caller ID fields
- Avoid relying on escaping as the primary SQL injection defense
- Restrict the database account used by the module to only the required records and operations
- Protect administrator-account data with additional authorization and integrity controls
- Apply security fixes through the organization's normal supported maintenance process
Mitigation should focus on removing SQL interpretation from untrusted SIP metadata and reducing the privileges available to the affected database operation.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database write
- Treat Caller ID and other SIP-derived metadata as untrusted input
- Apply schema-aware validation and length limits appropriate to Caller ID fields
- Avoid relying on escaping as the primary SQL injection defense
- Restrict the database account used by the module to only the required records and operations
- Protect administrator-account data with additional authorization and integrity controls
- Apply security fixes through the organization's normal supported maintenance process
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying SQL construction with string concatenation or interpolation
- Code review checks for database calls that receive SIP headers or other external metadata directly
- Tests using quotation marks, delimiters, and unexpected length values in Caller ID fields
- Monitoring for anomalous missed-call records, unexpected administrator-account changes, or database errors following inbound calls
- Policy enforcement requiring prepared statements and approved database-access abstractions
- Automated security review tools that flag unparameterized SQL paths
Organizations can look for this class of issue through:
- Static analysis rules identifying SQL construction with string concatenation or interpolation
- Code review checks for database calls that receive SIP headers or other external metadata directly
- Tests using quotation marks, delimiters, and unexpected length values in Caller ID fields
- Monitoring for anomalous missed-call records, unexpected administrator-account changes, or database errors following inbound calls
- Policy enforcement requiring prepared statements and approved database-access abstractions
- Automated security review tools that flag unparameterized SQL paths
