FreePBX web interface remote vulnerability The admin username and password for the web interface is stored in plain text in this publicly accessible file: http://yourip/admin/modules/framework/bin/gen_amp_conf.php Which allows a hacker to access the web GUI and view the secrets(passwords) for each extension in plain test, as well as change the outbound routes. Further details on this exploit can be found here: http://linuxsecurityblog.com/2012/02/freepbx-vulnerable/ This was claimed to have been fixed around December 2011, however the vulnerability never made it to bugtraq. http://www.freepbx.org/forum/freepbx/development/security-gen-amp-conf-php I have confirmed this has been fixed as of: FreePBX 2.10.0rc1.1 and distro release 1.88.210.57-1 And it appears to have affected versions for at least 1 year prior to their fix.
