Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/imbios/lab-cve-2025-57819
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationLabs & Practice
GitHubimbios/lab-cve-2025-57819

lab-cve-2025-57819

FreePBX CVE-2025-57819 lab (Docker) + Nuclei POC for unauth SQLi (time-based).

View Repository
1211 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

(Work in Progress) FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain (Nuclei POC)

Spin up a reproducible FreePBX 15 lab (Docker) to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template (behavior-based, not version checks) and a debug-friendly test harness.

Highlights

  • Unauthenticated time-based SQLi POC (SLEEP) on userman endpoints
  • Minimal Docker Compose (MariaDB + FreePBX 15)
  • Nuclei POC template with -debug validation
  • Make targets for quick bring-up and test

Quick Start

Prereqs: Docker + Docker Compose. For Nuclei, either install locally or use the official container (used by default).

root@kitploit:~
# bring up the lab
make up

# wait until FreePBX is responding
make wait

# quick timing check (expect ~6s delay on injected request)
make check

# run nuclei POC with debug (via Docker)
make test-nuclei

# all-in-one
make test

If you have Nuclei installed locally, you can run:

root@kitploit:~
nuclei -u http://127.0.0.1:8080 -t templates/CVE-2025-57819.yaml -vv -debug -debug-req -debug-resp

How It Works

  • Vulnerable endpoints:
    • /admin/ajax.php?module=userman&command=checkPasswordReminder
    • /ucp/ajax.php?module=userman&command=checkPasswordReminder
  • The template sends a baseline POST and a SLEEP-injected POST. A ≥5s delay on the injected request indicates likely SQLi.
  • This is a detection-only POC (non-destructive). Do not attempt file writes in shared environments.

Repository Layout

root@kitploit:~
.
├── docker-compose.yml
├── Makefile
├── scripts/
│   └── test.sh
└── templates/
    └── CVE-2025-57819.yaml

References

  • FreePBX advisory: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
  • PoC 1: https://github.com/blueisbeautiful/CVE-2025-57819
  • PoC 2: https://github.com/net-hex/CVE-2025-57819

Disclaimer

For educational and authorized testing only. Test only assets you own or have explicit permission to test.

SEO Keywords

freepbx cve-2025-57819, freepbx sql injection, freepbx rce, userman ajax.php exploit, nuclei template cve-2025-57819, freepbx security lab, pentest lab freepbx

Download Tool