shivammittal2403/cve-2025-57819-freepbx-rangeIsolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX.
Isolated educational cyber-range for CVE-2025-57819 (CWE-89, CWE-288).
Original FreePBX-compatible training application — not official Sangoma FreePBX.
git clone https://github.com/shivammittal2403/cve-2025-57819-freepbx-range
cd cve-2025-57819-freepbx-range
cp .env.example .env
# Optional patched profile source:
cp -a target/app target/apache target/php target/scripts target-patched/
docker compose build
docker compose up -d
admin / admin)docker exec -it cve57819-attacker bashdocker compose --profile patched up -d → :8081| Service | Role |
|---|---|
| target | Apache + PHP FreePBX-style GUI + vulnerable endpoint |
| database | MariaDB |
| pbx | Allowlisted scheduler |
| attacker | Tools workstation |
| observer | SOC log monitor |
| frontend | Range dashboard |
127.0.0.1 by defaultwrite_flag, etc.)See challenges/ — recon → auth boundary → endpoint → SQLi → DB → cron → exec → forensics → detection → remediation.
docs/STUDENT.md, docs/INSTRUCTOR.md, docs/VULNERABILITY.md, docs/ATTACK_CHAIN.md
MIT — educational use only. See SECURITY.md.