CVE-2007-6170
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in...
CVE-2007-6170 is a medium vulnerability (CVSS 6.5) in Digium Asterisk, published November 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. Fixed in asterisk 1:1.4.15~dfsg-1.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 2.81%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:1.4.15~dfsg-1asterisk +2 more
Description
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 | before 1:1.4.15~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 | 1:1.4.15~dfsg-1 |
asteriskDebian:3.1 | before 1:1.0.7.dfsg.1-2sarge6, plus listed versions 1:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge5 | 1:1.0.7.dfsg.1-2sarge6 |
asteriskDebian:4.0 | before 1:1.2.13~dfsg-2etch2, plus listed versions 1:1.2.13~dfsg-21:1.2.13~dfsg-2etch1 | 1:1.2.13~dfsg-2etch2 |
What each source reports
NVD Score used
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
CVE-2007-6170- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE ListNo score
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
CVE-2007-6170- Updated
- 2026-11-02
EUVDEUVD-2007-6139No score
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
EUVD-2007-6139- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mcqx-w3j9-p34hNo score
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in...
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
GHSA-mcqx-w3j9-p34h- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVNo score
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
CVE-2007-6170- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6170No score
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
- Record
DEBIAN-CVE-2007-6170- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/29782
security.gentoo.org/glsa/glsa-200804-13.xml
securityfocus.com/archive/1/484388/100/0/threaded
downloads.digium.com/pub/security/AST-2007-026.html
Show 10 moreShow less
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
securitytracker.com/id?1019020
debian.org/security/2007/dsa-1417
exchange.xforce.ibmcloud.com/vulnerabilities/38765
vupen.com/english/advisories/2007/4056
nvd.nist.gov/vuln/detail/CVE-2007-6170
github.com/advisories/GHSA-mcqx-w3j9-p34h
security-tracker.debian.org/tracker/CVE-2007-6170
Left out here: 36 versions. The JSON record has them.