Freepbx Exploit

Wow, what a week.  You move data centres and then find of an exploit that you weren't aware of.  Big thanks to freepbx for this one.  Not really sure why this little gem isn't documented in many places, but it's a good one.
When you use database authentication in freepbx the Database user and pass gets admin access to the system.  That sounds a little strange, but what it means is that if you have installed a clean install of freepbx, despite the fact that you have set a root password etc. access to the database asterisk is granted to the default user of:

freepbx - fpbx

Now, if you login to your web administration using those credentials it will grant you full admin access.  thus completely opening your system.  To modify the details you need to edit /etc/amportal.conf and change the following  option... once you have changed that don't forget to give that user/pass the mysql access to get into the asterisk database an example is shown on the second line

AMPDBPASS=SOMENEWPASS

 mysql> grant all on asterisk.* to freepbx@localhost identified by 'SOMENEWPASS'

Please bear in mind that you will still be able to get into the system using freepbx and SOMENEWPASS, so make it secure!!