FreePBX SQL Injection Vulnerability Exploited to Modify The Database

Cybersecurity: FreePBX SQL Injection Vulnerability

A critical SQL injection vulnerability identified as CVE-2025-57819 has been discovered in FreePBX, posing a significant risk to VoIP infrastructure globally. This vulnerability allows attackers to manipulate database contents and execute arbitrary code.

FreePBX, based on the open-source Asterisk VoIP platform, is a widely utilized PBX system that provides web-based administrative capabilities for telecommunications infrastructure management.

The vulnerability permits malicious actors to inject SQL commands through vulnerable web application parameters, specifically targeting the system’s database management functions. Attackers have been actively exploiting this vulnerability to compromise FreePBX installations using sophisticated database manipulation techniques.

The attack exploits the system’s ajax.php endpoint, where inadequate input sanitization allows SQL injection through the "brand" parameter. Malicious GET requests containing SQL payloads are crafted to insert unauthorized entries into the cron_jobs database table, effectively establishing persistent access mechanisms within the compromised system.

Internet Storm Center analysts identified this vulnerability in active exploitation campaigns. The exploitation attempts demonstrate advanced techniques that extend beyond simple database manipulation, incorporating elements of persistence and stealth to maintain unauthorized access while avoiding detection.

Database Manipulation and Code Execution Mechanism

The exploitation methodology involves injecting carefully crafted SQL statements into the FreePBX database through the vulnerable brand parameter in ajax.php requests. A typical exploit payload appears as follows:

GET /admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x'; INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order) VALUES ('sysadmin','takdak','echo "PD9waHAgaGVhZGVyKCd4X3BvYzogQ1ZFLTIwMjUtNTc4MTknKTsgZWNobyBzaGVsbF9leGVjKCd1bmFtZSAtYScpOyB1bmxpbmsoX19GSUxFX18pOyA/Pgo="|base64 -d ]/var/www/html/rspgf.php',NULL,' *',30,1,1) --

This malicious payload inserts a new entry into the cron_jobs table, which FreePBX utilizes for scheduled task management. The base64-encoded command, when decoded, reveals a PHP script containing:

This technique transforms database manipulation into direct code execution by exploiting FreePBX’s cron job management system, creating web-accessible PHP files that execute system commands. It also implements self-deletion mechanisms to evade forensic analysis .

Based on reporting by Cyber Security News.