VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
Vulnerability Description
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34099
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- bcoles
Affected Vendor
VICIdial Group
View all reports →