CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE

Unauthenticated stacked SQL injection in the FreePBX Endpoint Manager module (admin/ajax.php, brand parameter), CVE-2025-57819, affecting FreePBX framework < 16.0.89. It is escalated to remote code execution by INSERTing a row into FreePBX's own cron_jobs table so the appliance cron runner writes an attacker webshell within ~60s (exec as the asterisk user).

CVE: CVE-2025-57819

Requirements

python3 -m pip install requests    # for the Python PoC(s)

Usage

python3 exploit.py <target> [--vhost <name>] [--root] [--cmd <shell cmd>]

How it works

1. Confirm the SQL injection
2. Stacked query to webshell to RCE as asterisk
3. Find the root primitive
4. Escalate to root

References

• https://github.com/itsC1SCO/FreePBX-SQLi-Exploit-Privilege-escalation

Disclaimer

For authorised security testing and education only. Only run this against systems you own or have explicit written permission to test.

Author: r3vpwnx