This vulnerability exists in FreePBX Framework 17.0 within the /admin/ajax.php dispatcher located in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php. The dispatcher does not implement CSRF tokens and relies only on a Referer header check for protection. An attacker can bypass this check by sending requests without a Referer header or from a same-site context, allowing them to perform administrative actions on behalf of an authenticated administrator without requiring prior authentication. This flaw is classified as CWE-352 (Cross-Site Request Forgery) and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to perform administrative actions with the privileges of an authenticated administrator. This can lead to full compromise of the affected FreePBX Framework instance, including unauthorized configuration changes and potential disruption of telephony services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit access to the FreePBX administrative interface and avoid visiting untrusted websites while logged in. Monitoring vendor channels for updates is strongly recommended.