A remote attacker can bypass authentication and create a false FreePBX Administrator account, which will then let them perform any action on a FreePBX system as the FreePBX user (which is often ‘asterisk’ or ‘apache’). As of 2014/10/01 all versions of FreePBX are affected.