PBXCoreREST/Controllers/Files/PostController.php dans MikoPBX jusqu'à la version 2024.1.114 permet de télécharger un script PHP dans un répertoire arbitraire.

The impact of this vulnerability is severe. Successful exploitation allows an attacker to execute arbitrary code on the MikoPBX server. This could lead to complete system compromise, including data theft, modification, or deletion. Attackers could also leverage the compromised server to launch further attacks against internal network resources, effectively using the VoIP system as a pivot point. Given the sensitive nature of VoIP communications (potentially containing call recordings, voicemails, and user credentials), the potential for data exfiltration is significant. The ability to execute arbitrary code also opens the door to denial-of-service attacks and the installation of persistent backdoors.

Organizations utilizing MikoPBX for their VoIP communications are at risk, particularly those running older, unpatched versions. Small and medium-sized businesses (SMBs) with limited security resources are especially vulnerable, as they may lack the expertise or time to promptly address this critical vulnerability. Shared hosting environments where multiple customers share the same server are also at increased risk, as a compromise of one customer's MikoPBX instance could potentially impact others.

• php / server:

find /var/www/mikoPBX -name '*.php' -type f -mtime +7 -print

• php / server:

grep -r "<?php" /var/www/mikoPBX/PBXCoreREST/Controllers/Files/

• generic web:

curl -I http://your-mikoPBX-server/PBXCoreREST/Controllers/Files/PostController.php | grep -i 'content-type: multipart/form-data'

1. 2025-06-27Disclosure

   disclosure

1. Réservé2025-06-16
2. Publiée2025-06-27
3. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade MikoPBX to version 2024.1.115 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions within the PBXCoreREST application to prevent unauthorized uploads. Implement strict input validation on all file uploads to ensure that only allowed file types are processed. Consider using a Web Application Firewall (WAF) to block suspicious file upload attempts. Monitor system logs for unusual file activity, particularly the creation of PHP files in unexpected directories.