What’s Vulnerable › Vulnerabilities

CVE-2018-15892

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-20 · updated 2026-06-17
• Weakness: CWE-89

Description

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.

Affected products

• FreePBX Disa: before 13.0.6.2 — fixed in 13.0.6.2

How to fix

Upgrade to a fixed version: FreePBX Disa 13.0.6.2. Check the vendor advisory for mitigations.

References

• https://wiki.freepbx.org/display/FOP/2018-09-11+DISA+SQL+Injection
• https://www.freepbx.org/
• https://wiki.freepbx.org/display/FOP/2018-09-11+DISA+SQL+Injection
• https://www.freepbx.org/

Get alerted when CVE-2018-15892 or the next vulnerability affects your stack