CyberRota Analysis
AI-GeneratedFrogman versions prior to 1.6.2 are vulnerable due to improper storage of API tokens, which are stored as raw strings, allowing attackers to recover active tokens and gain unauthorized database access at the associated permission level, including administrative rights. Organizations using Frogman for PBX control should prioritize upgrading to version 1.6.2 to mitigate the risk of token exploitation and potential data breaches. This vulnerability poses a significant threat to systems relying on the API for secure communications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.