CVE-2021-37441

Description

NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.

Affected Platforms

Weakness Type

CWE-22

References

• https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md
• https://www.nch.com.au/pbx/index.html
• https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md
• https://www.nch.com.au/pbx/index.html