Elastix 2.5 + before - SQL Injection - A2Billing

[Bob1]

SQL Injection Vulnerability in A2Billing

For more info...
http://packetstormsecurity.com/files/13 ... ction.html

Includes fix in link as well..

Regards

Bob

 

[Romolo1]

About this and other possible a2billing bugs:
looking to the a2billing code I have seen several scripts that are prone to SQL injection.
Considering the fact that the version supplied with elastix is rather old, how to contribute fixes ?
BTW: I don't want to disclose possible bugs on a public forum, at least not before fixes are available.

Meanwhile people not using a2billing should indeed consider to remove it from their installations, and also it should be provided as optional (possibly insecure) during elastix installation process.
The same considerations apply for all the other unused modules like vtigercrm.

Remember: What is not present cannot be used for attacks.

 

[Romolo1]

Is indeed incredible how many bus are in a2billing code, isn't there any developer available to report them to ?
I repeat: I do not want to report them on a public forum, but I really strongly suggest all user to uninstall a2billing or block http/https access from outside.
There are tons of sql injections available for unregistered users and tons to registered ones.

 

[milocheri]

Actually A2billing Version is 2.0.12, the one with Elastix is very old

 

[Romolo1]

I know that a2billing in asterix is very old, my only concerns are:
1) a2billing should not be installed by default but as additional module, the same apply for all CRMS, Looking to my web server logs most of attacks are against a2billing and vtigercrm
2) I really hope that in the upcoming elastix 4.0 a2billing will follow the mainstream so it will be easily updatable by user
3) it will be better to provide basic security configuration maybe configuring asterisk security log and fail2ban configuration to avoid brute force attacks

Elastix is very nice for beginner users that have little sysadm background but for that reason is very prone to be hacked due to poor/incomplete configuration, I think that this is not good for elastix.

A grep about file do not exist on my web server:

[Tue Mar 31 22:01:35 2015] [error] [client 37.220.10.202] File does not exist: /var/www/html/a2billing
[Tue Mar 31 23:41:25 2015] [error] [client 80.243.177.183] File does not exist: /var/www/html/a2billing
[Wed Apr 01 00:07:27 2015] [error] [client 207.249.162.90] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 02:09:31 2015] [error] [client 71.179.237.58] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 02:41:02 2015] [error] [client 37.8.32.225] File does not exist: /var/www/html/vtigercrm, referer: http://1337s.cc/index.php
[Wed Apr 01 02:41:03 2015] [error] [client 37.8.32.225] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 02:41:04 2015] [error] [client 37.8.32.225] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 14:15:01 2015] [error] [client 64.14.99.254] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 16:21:10 2015] [error] [client 192.99.119.158] File does not exist: /var/www/html/vtigercrm
[Wed Apr 01 19:45:33 2015] [error] [client 194.226.171.20] File does not exist: /var/www/html/vtigercrm
[Thu Apr 02 17:40:24 2015] [error] [client 85.114.139.18] File does not exist: /var/www/html/vtigercrm
[Fri Apr 03 02:13:17 2015] [error] [client 46.226.13.98] File does not exist: /var/www/html/CFIDE
[Fri Apr 03 02:13:18 2015] [error] [client 46.226.13.98] File does not exist: /var/www/html/CFIDE
[Fri Apr 03 02:13:18 2015] [error] [client 46.226.13.98] File does not exist: /var/www/html/CFIDE
[Fri Apr 03 02:13:19 2015] [error] [client 46.226.13.98] File does not exist: /var/www/html/CFIDE
[Fri Apr 03 05:46:09 2015] [error] [client 151.80.223.221] File does not exist: /var/www/html/web-meetme

The ones about CFIDE are clearly a scan against coldfusion server so not elastix related.