CVE-2026-28210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28210", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.648Z", "datePublished": "2026-03-05T18:24:06.156Z", "dateUpdated": "2026-03-07T04:55:28.948Z"}, "containers": {"cna": {"title": "FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v"}], "affected": [{"vendor": "FreePBX", "product": "security-reporting", "versions": [{"version": "< 16.0.49", "status": "affected"}, {"version": "< 17.0.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T18:24:06.156Z"}, "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7."}], "source": {"advisory": "GHSA-59gp-632h-c54v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-28210"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-07T04:55:28.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T15:58:35.139125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:58:36.186Z"}}], "cna": {"title": "FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports", "source": {"advisory": "GHSA-59gp-632h-c54v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FreePBX", "product": "security-reporting", "versions": [{"status": "affected", "version": "< 16.0.49"}, {"status": "affected", "version": "< 17.0.7"}]}], "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v", "name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T18:24:06.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28210", "state": "PUBLISHED", "dateUpdated": "2026-03-07T04:55:28.948Z", "dateReserved": "2026-02-25T15:28:40.648Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T18:24:06.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "security-reporting", "vendor": "FreePBX", "versions": [{"status": "affected", "version": "< 16.0.49"}, {"status": "affected", "version": "< 17.0.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF8E0AA5-491B-46F4-93E1-662865647A66", "versionEndExcluding": "16.0.49", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "matchCriteriaId": "683B9ECF-40AF-4DA2-9938-DEC0597DFA3D", "versionEndExcluding": "17.0.7", "versionStartIncluding": "17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7."}, {"lang": "es", "value": "FreePBX es una IP PBX de c\u00f3digo abierto. Antes de las versiones 16.0.49 y 17.0.7, el m\u00f3dulo cdr (Registro de Datos de Llamada) de FreePBX es vulnerable a la inyecci\u00f3n de consultas SQL. Este problema ha sido parcheado en las versiones 16.0.49 y 17.0.7."}], "id": "CVE-2026-28210", "lastModified": "2026-06-17T10:28:20.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28210", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-05T19:16:14.713", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.0.49)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,17.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "security-reporting", "source": "cna", "vendor": "FreePBX"}, "product": "security-reporting", "vendor": "freepbx"}], "analysis": {"en": {"generated_at": "2026-04-17T12:42:09.412920+00:00", "value": {"mitigation_remediation": ["Upgrade FreePBX to version 16.0.49 or later, or 17.0.7 or later, which addresses the injection flaw.", "Restrict access to the CDR reporting feature so that only trusted, privileged users can use it while the update is pending.", "Conduct a database backup before applying the update to preserve data integrity."], "summary": {"action": "Immediate Patch", "impact": "SQL Injection enabling unauthorized data access"}, "threat_synthesis": {"affected_systems": "Any installation of FreePBX running a version prior to 16.0.49 or 17.0.7 is affected. The vulnerability resides in the FreePBX CDR module and is exposed through the CDR reporting interface. Systems using older FreePBX releases\u2014particularly those including the security-reporting component\u2014must verify their version and apply fixes if necessary.", "description_and_impact": "This vulnerability exists in the FreePBX Call Data Record (CDR) reporting module and allows an attacker with authenticated access to inject arbitrary SQL into queries that retrieve CDR data. The injection can lead to unauthorized reading of sensitive call records, modification or deletion of database entries, or other destructive actions. The weakness is a classic SQL Injection identified as CWE-89, which signals unsafe handling of untrusted input. Based on the description, it is inferred that the attacker must possess valid user credentials to exploit this flaw.", "risk_and_exploitability": "The CVSS score of 8.6 indicates a high severity overall. With an EPSS below 1% and no current listing in the CISA KEV catalog, the likelihood of widespread exploitation is low, but the remaining factors\u2014namely the requirement for authenticated access and the vulnerable database interface\u2014mean that a knowledgeable attacker could discover and exploit the flaw. The likely attack vector is through the CDR reporting feature, and it is inferred that the attacker must have valid user credentials with access to this feature. Once authenticated, the attacker could manipulate the SQL query parameter to extract or alter data."}}}}, "created": "2026-03-06T15:01:31.003887+00:00", "updated": "2026-04-17T12:45:16.160225+00:00", "vendors": ["freepbx", "freepbx$PRODUCT$security-reporting"]}