KobiPBX-FOP3-SEC (< R1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kobipbx-fop3-sec--r1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 14:41:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKobikom KobiPBX: SQL injection vulnerability (CVE-2026-105321)https://feed.craftedsignal.io/briefs/2026-11-kobikom-sqli/Thu, 05 Nov 2026 14:41:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kobikom-sqli/An SQL injection vulnerability exists in Kobikom KobiPBX versions prior to r1, allowing attackers to inject arbitrary SQL commands into the backend database.Kobikom Telecommunications and Informatics Services Inc. has disclosed an improper neutralization of special elements used in an SQL command (SQL injection) vulnerability within its KobiPBX product. The flaw exists in versions prior to KobiPBX-FOP3-SEC-r1. Exploitation could allow an attacker to perform unauthorized database actions, such as data retrieval or modification.

Impact

Successful exploitation allows for unauthorized interaction with the backend database. While specific impact is not documented, SQL injection typically permits data exfiltration, database manipulation, or authentication bypass.

Recommendation

  • Inventory all instances of Kobikom KobiPBX within the network to identify versions below KobiPBX-FOP3-SEC-r1.
  • Upgrade all affected KobiPBX installations to the secure release (KobiPBX-FOP3-SEC-r1) or newer immediately.
  • Until patching is complete, restrict access to the web management interface of KobiPBX to authorized internal management networks only.
]]>highadvisorysqlivulnerabilitywebserver