PBXCoreREST/Controllers/Files/PostController.php in MikoPBX 2024.1.114 से पहले के संस्करणों में एक PHP स्क्रिप्ट को किसी भी डाइरेक्टरी में अपलोड करने की अनुमति देता है।

The impact of this vulnerability is severe. Successful exploitation allows an attacker to execute arbitrary code on the MikoPBX server. This could lead to complete system compromise, including data theft, modification, or deletion. Attackers could also leverage the compromised server to launch further attacks against internal network resources, effectively using the VoIP system as a pivot point. Given the sensitive nature of VoIP communications (potentially containing call recordings, voicemails, and user credentials), the potential for data exfiltration is significant. The ability to execute arbitrary code also opens the door to denial-of-service attacks and the installation of persistent backdoors.

Organizations utilizing MikoPBX for their VoIP communications are at risk, particularly those running older, unpatched versions. Small and medium-sized businesses (SMBs) with limited security resources are especially vulnerable, as they may lack the expertise or time to promptly address this critical vulnerability. Shared hosting environments where multiple customers share the same server are also at increased risk, as a compromise of one customer's MikoPBX instance could potentially impact others.

• php / server:

find /var/www/mikoPBX -name '*.php' -type f -mtime +7 -print

• php / server:

grep -r "<?php" /var/www/mikoPBX/PBXCoreREST/Controllers/Files/

• generic web:

curl -I http://your-mikoPBX-server/PBXCoreREST/Controllers/Files/PostController.php | grep -i 'content-type: multipart/form-data'

1. 2025-06-27Disclosure

   disclosure

1. आरक्षित2025-06-16
2. प्रकाशित2025-06-27
3. EPSS अद्यतन2026-03-23

The primary mitigation is to immediately upgrade MikoPBX to version 2024.1.115 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions within the PBXCoreREST application to prevent unauthorized uploads. Implement strict input validation on all file uploads to ensure that only allowed file types are processed. Consider using a Web Application Firewall (WAF) to block suspicious file upload attempts. Monitor system logs for unusual file activity, particularly the creation of PHP files in unexpected directories.