cyberleelawat/freepbx-multiple-cves-2025This repository documents three security vulnerabilities discovered in FreePBX (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675), including analysis, impact, and proof-of-concept details for security research and awareness purposes.
This repository documents three security vulnerabilities discovered in FreePBX (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675), including analysis, impact, and proof-of-concept details for security research and awareness purposes.
🔴 CVE-2025-61675
A security flaw in FreePBX resulting from improper handling of user-controlled input. This issue may allow an attacker to influence application functionality and potentially impact overall system security.
🔴 CVE-2025-61678
FreePBX contains an input validation vulnerability that may allow attackers to manipulate application behavior. Successful exploitation could affect confidentiality and integrity depending on the attack vector used.
🔴 CVE-2025-66039
This vulnerability in FreePBX is caused by improper access control, allowing an attacker to perform unauthorized actions. Exploitation of this issue can lead to security risks impacting the integrity of the affected FreePBX system.
Affected Versions
How does this detection method work?These templates detect vulnerable FreePBX instances by:
The detection is non-invasive and does not attempt to exploit the vulnerabilities.
http.title:"FreePBX Administration"
product.name="FreePBX Console"
🌐 Google Dorks
intitle:"FreePBX Administration"
"FreePBX" "Administration"
inurl:/admin/config.php "FreePBX"
🔍 Shodan
http.title:"FreePBX"
http.html:"FreePBX Administration"
product:"FreePBX"
🛰️ FOFA
title="FreePBX"
body="FreePBX Administration"
app="FreePBX"
👁️ ZoomEye
app:"FreePBX"
title:"FreePBX"
🌐 Google Dorks
"FreePBX" "User Control Panel"
inurl:/ucp/login
"FreePBX" "UCP"
🔍 Shodan
http.html:"User Control Panel"
http.html:"FreePBX"
🛰️ FOFA
body="User Control Panel"
body="FreePBX"
👁️ ZoomEye
app:"FreePBX"
body:"User Control Panel"
🌐 Google Dorks
inurl:/admin "FreePBX"
inurl:/recordings "FreePBX"
"FreePBX" "Dashboard"
🔍 Shodan
http.html:"FreePBX Dashboard"
http.favicon.hash:-1238045827
🛰️ FOFA
body="FreePBX Dashboard"
icon_hash="-1238045827"
👁️ ZoomEye
app:"FreePBX"
body:"Dashboard"
How do I run this script?git clone https://github.com/cyberleelawat/FreePBX-Multiple-CVEs-2025.git
cd FreePBX-Multiple-CVEs-2025
nuclei -u https://example.com -t CVE-2025-61675.yaml
nuclei -l subdomain.txt -t CVE-2025-61675.yaml
nuclei -u https://example.com -t CVE-2025-61678.yaml
nuclei -l subdomain.txt -t CVE-2025-61678.yaml
nuclei -u https://example.com -t CVE-2025-66039.yaml
nuclei -l subdomain.txt -t CVE-2025-66039.yaml
nuclei -u https://example.com -t .
[CVE-2025-61675] [http] [high] FreePBX Authenticated SQL Injection
[CVE-2025-61678] [http] [high] FreePBX Authenticated Arbitrary File Upload
[CVE-2025-66039] [http] [critical] FreePBX Authentication Bypass
References
DisclaimerUse at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.