cybertechajju/cve-2025-57819Nuclei-based toolkit for detecting and validating the FreePBX authentication bypass vulnerability (CVE-2025-57819) with detection and exploit PoC templates.
📖 Table of Contents
About This Project
Key Features
Vulnerability Breakdown
Templates in Action
Finding Targets with Shodan
Legal Disclaimer
Connect with Me
Show Your Support
📌 About This Project This repository is your go-to arsenal for tackling the FreePBX authentication bypass vulnerability (CVE-2025-57819). It includes two powerful Nuclei templates:
🔍 Detection Template: Safely identifies vulnerable FreePBX instances without any intrusive actions.
💥 Exploit PoC Template: Validates the vulnerability by creating a temporary admin user. (Use with extreme caution!)
⚠️ Note: This toolkit is strictly for educational, research, and authorized bug bounty purposes only. Any unauthorized use is illegal.
✨ Key Features 🎯 Accurate Detection: Targets specific vulnerable versions (15, 16, 17) for reliable results.
🔌 Exploit PoC: Includes a proof-of-concept to validate findings by creating a temporary user.
🌐 Shodan Integration: Comes with a ready-to-use Shodan dork to find potential targets.
💻 Professional Syntax: Clean, efficient, and well-documented Nuclei templates.
🔧 Easily Extensible: Simple to modify and integrate into your custom workflows.
🔍 Vulnerability Breakdown 🆔 CVE ID: CVE-2025-57819
📦 Component: FreePBX modular.php (Admin Endpoint)
💥 Impact: Authentication Bypass → Database Manipulation → Potential RCE
🔥 Severity: Critical (CVSS 10.0)
🔬 Affected Versions:
FreePBX < 15.0.66
FreePBX < 16.0.89
FreePBX < 17.0.3
🚀 Templates in Action 1️⃣ Detection Template (freepbx-cve-2025-57819-detect.yaml) This template safely checks for the vulnerability without performing any modifications.
nuclei -t freepbx-cve-2025-57819-detect.yaml -u https://target.com
🌐 Finding Targets with Shodan Use this dork to discover potentially vulnerable FreePBX administration panels on the internet:
http.title:"FreePBX Administration"
⚠️ Legal Disclaimer This repository and its contents are provided for security researchers, bug bounty hunters, and educational purposes. The author, CyberTEchAjju, is not responsible for any damage or misuse caused by these templates. Engaging in unauthorized scanning or exploitation is illegal. Always act responsibly and ethically.
⭐ Show Your Support If you found this repository useful, please consider giving it a ⭐ on GitHub and sharing it with the community!
