iNextrix/ASTPP

iNextrix/ASTPP

www.astppbilling.org

Releases11

Frequency8 months 2 weeks

Last Release over 2 years ago

Stars176

Open Source VoIP Billing Solution http://www.astppbilling.org | Report a bug https://inextrix.atlassian.net/jira/projects

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-37104 ↗	Feb 11, 2026Wednesday, 11 February 2026, 21:16	7.5 HIGH	—
ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.
CVE-2020-37153 ↗	Feb 11, 2026Wednesday, 11 February 2026, 21:16	9.8 CRITICAL	—
ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.
CVE-2019-15075 ↗	Mar 20, 2020Friday, 20 March 2020, 18:15	7.5 HIGH	5 MEDIUM
An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.