CVE-2013-4467

CVE-2013-4467 describes multiple SQL injection vulnerabilities affecting the agent interface of VICIDIAL dialer versions 2.8-403a, 2.7, 2.7RC1, and earlier. These flaws allow remote attackers, both unauthenticated and authenticated, to execute arbitrary SQL commands through various parameters, such as the 'campaign' variable in SCRIPT_multirecording_AJAX.php or the 'server_ip' parameter in manager_send.php. With a CVSS score of 6.5, this vulnerability is of medium severity, indicating that an attacker can exploit it over the network with low complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. Its high EPSS score of 0.78 suggests a significant likelihood of exploitation. While not listed on the CISA KEV catalog, exploit code is publicly available through a Metasploit module (EDB-29513), demonstrating its exploitability. Despite this, there is no recorded community discussion or media coverage, which is typical for the vast majority of CVEs.