Insufficiently sanitized data allows unauthenticated access to FreePBX Admin
19 hours ago
- #FreePBX
- #VoIP
- #CVE-2025-57819
- A zero-day vulnerability (CVE-2025-57819) was discovered in FreePBX, an open-source GUI for managing Asterisk VoIP systems.
- Attackers exploited the vulnerability to compromise FreePBX hosts, gaining access to phone calls, voicemails, and recordings.
- The exploit chain involves a pre-authentication SQL Injection in the Endpoint module, allowing attackers to execute arbitrary commands.
- FreePBX's custom autoloader allows unauthenticated access to certain PHP files, bypassing authentication checks.
- Attackers used the SQL Injection to insert malicious cron jobs, achieving remote code execution (RCE).
- The official patch fixes the SQL Injection but leaves the authentication bypass issue unaddressed.
- A Detection Artefact Generator (DAG) was released to help identify compromised systems.