FreePBX SQL Injection Vulnerability Leads to Database Tampering
A critical SQL injection vulnerability identified as CVE-2025-57819 has been discovered in FreePBX, an open-source PBX platform. This vulnerability has been actively exploited by attackers to modify databases and execute arbitrary code on affected…
A critical SQL injection vulnerability identified as CVE-2025-57819 has been discovered in FreePBX, an open-source PBX platform. This vulnerability has been actively exploited by attackers to modify databases and execute arbitrary code on affected systems.
The vulnerability impacts FreePBX versions 15, 16, and 17. It resides within the endpoint module's AJAX handler, specifically in the /admin/ajax.php endpoint, due to inadequate input sanitization of the "brand" parameter.
Attackers can exploit this by crafting requests that inject SQL commands directly into the FreePBX database. This allows them to insert arbitrary entries into the cron_jobs database table, which FreePBX uses for managing scheduled tasks. By manipulating this table, attackers can schedule and execute malicious commands, achieving persistent code execution.
Security researchers have observed active exploitation attempts involving sophisticated attacks that aim for complete system compromise. These attacks use payloads that create PHP web shells, providing remote command execution capabilities. A typical attack involves creating a Base64-encoded PHP file containing diagnostic commands, with a self-deletion mechanism and system command execution capabilities.
A critical SQL injection vulnerability identified as CVE-2025-57819 has been discovered in FreePBX, an open-source PBX platform.
This vulnerability poses significant security risks, enabling attackers to create backdoor accounts, alter call routing rules, access call detail records, and potentially exploit other network resources. The capability to execute arbitrary PHP code through the web interface grants extensive control over the FreePBX system and potentially the underlying Linux server.
Sangoma, the FreePBX development team, released security patches on August 28, 2025, addressing this vulnerability across all supported versions. It is crucial for organizations to update their FreePBX installations promptly using standard module update procedures through the Administrator Control Panel or command-line interface. Updates for the endpoint module are available through stable repositories for versions 15, 16, and 17.
To enhance security, organizations should implement network-level controls to restrict administrative access. Configuring the FreePBX Firewall module to limit access to trusted IP addresses is recommended. Security audits should include reviewing Apache logs for suspicious requests, examining the cron_jobs database table for unauthorized entries, and ensuring no malicious files exist in the web root directory.
In the event of a suspected compromise, organizations should follow comprehensive incident response procedures, such as restoring systems from clean backups, rotating passwords for all accounts, and conducting forensic analysis of call logs and billing records. The public disclosure of this vulnerability underscores the importance of maintaining current security patches and implementing robust security strategies.
Based on reporting by GBHackers.