FreePBX, an open source IP PBX system, contains an SQL injection vulnerability (CWE-89) in its security-reporting component, specifically in the CDR Reports module page. The flaw allows SQL injection through the order and sort POST parameters when accessed by an authenticated user with CDR section access. This vulnerability exists in versions prior to 16.0.50 and from 17.0.1 up to 17.0.11. Exploitation does not require full administrator privileges but does require authentication with a FreePBX Administration Control Panel account that has CDR access. The issue is resolved in versions 16.0.50 and 17.0.11.

Successful exploitation of this vulnerability could allow an authenticated user with limited privileges (CDR section access) to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation within the FreePBX system's database. The CVSS 4.0 score of 8.5 reflects a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

This vulnerability is fixed in FreePBX versions 16.0.50 and 17.0.11. Users should upgrade to these or later versions to remediate the issue. Since the vendor advisory does not specify any temporary fixes or workarounds, upgrading is the recommended mitigation. Patch status is confirmed by the vendor's versioning information in the description.