CVE-2013-10043

CVE-2013-10043 is a critical vulnerability affecting OAstium VoIP PBX astium-confweb-2.1-25399 and earlier versions. It allows unauthenticated attackers to bypass authentication via SQL injection in logon.php, then upload arbitrary PHP code through import.php to achieve remote code execution with root privileges. Rated 9.5 CRITICAL, this vulnerability has a low attack complexity and requires no user interaction, making it highly severe. Successful exploitation leads to full system compromise, including complete confidentiality, integrity, and availability loss. Exploit code is publicly available via a Metasploit module, and the vulnerability has garnered significant community discussion, indicating awareness and potential for exploitation. While not on the KEV catalog, its high EPSS score and FAUCET Risk Score suggest a high likelihood of exploitation.