Vulnerability record · CVE-2014-1903 · published 18 February 2014
CVE-2014-1903: FreePBX API handler allows arbitrary PHP code execution
Freepbx · Freepbx
FreePBX versions 2.9 through 12 (before their respective fixed builds) fail to restrict which functions the API handler in admin/libraries/view.functions.php can call. Because the function and args parameters to admin/config.php are not validated against an allowlist, an unauthenticated remote attacker can invoke arbitrary PHP functions. This is a full remote code execution flaw in a widely deployed PBX management interface.
Description
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution in an internet-exposed PBX management interface with public exploit code and very high EPSS probability.
What it is
FreePBX versions 2.9 through 12 (before their respective fixed builds) fail to restrict which functions the API handler in admin/libraries/view.functions.php can call. Because the function and args parameters to admin/config.php are not validated against an allowlist, an unauthenticated remote attacker can invoke arbitrary PHP functions. This is a full remote code execution flaw in a widely deployed PBX management interface.
Impact
An attacker can execute arbitrary PHP code on the FreePBX host, leading to full compromise of the PBX system, including configuration data, call handling and any credentials or extensions it manages.
Attack surface
Reachable over the network via HTTP requests to admin/config.php with crafted function and args parameters. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.52775 (98.9th percentile) and public exploit code exists, including a Packet Storm advisory and a GitHub PoC, so exploitation is feasible and likely.
What to do
- Upgrade FreePBX to the fixed builds: 2.9.0.14, 2.10.1.15, 2.11.0.23 or 12.0.1alpha22 and later.
- If immediate upgrade is not possible, restrict network access to admin/config.php and the admin interface to trusted management networks only.
- Apply the vendor's security notice guidance and review the referenced FreePBX changelogs for the API handler fix.
- Audit the FreePBX host for unexpected PHP files, web shells or modified admin code after exposure.
Detection
- Monitor web server logs for requests to admin/config.php containing function and args parameters, especially unusual or dangerous PHP function names.
- Alert on POST or GET requests to admin/config.php from untrusted source IPs or outside normal admin access patterns.
- Search the FreePBX webroot for newly created or modified PHP files that do not match known FreePBX releases.
- Review PHP error and audit logs for unexpected function calls or fatal errors originating from admin/config.php.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-1903 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-1903), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
