CVE-2025-57819

🗓️ 28 Aug 2025 16:45:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 44 Media mentions👁 809 Views🌐 WEB

Unauthenticated access enables SQL injection and remote code execution in FreePBX.

Reporter	Title	Published	Views	Family All 81
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Sep 202515:28	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	7 Jun 202600:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Jun 202610:22	–	githubexploit
GithubExploit	Exploit for CVE-2025-57819	29 Aug 202511:59	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	4 Sep 202503:21	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	6 Sep 202620:32	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	18 Sep 202520:38	–	githubexploit
GithubExploit	security-research	9 Jul 202615:08	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	27 Aug 202621:46	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	12 Sep 202517:53	–	githubexploit

NVD

Vulners

Node

sangoma freepbxRange15.0–15.0.66

sangoma freepbxRange16.0–16.0.89

sangoma freepbxRange17.0–17.0.3

[
  {
    "vendor": "FreePBX",
    "product": "endpoint",
    "versions": [
      {
        "version": "< 15.0.66",
        "status": "affected"
      },
      {
        "version": "< 16.0.89",
        "status": "affected"
      },
      {
        "version": "< 17.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
community	www.community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
github	www.github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

Parameter	Position	Path	Description	CWE
module	query param	admin/ajax.php	SQL injection via unsafely handled brand parameter in FreePBX endpoint AJAX call leading to arbitrary DB manipulation and possible RCE	CWE-89, CWE-288
command	query param	admin/ajax.php	SQL injection via unsafely handled brand parameter in FreePBX endpoint AJAX call leading to arbitrary DB manipulation and possible RCE	CWE-89, CWE-288
template	query param	admin/ajax.php	SQL injection via unsafely handled brand parameter in FreePBX endpoint AJAX call leading to arbitrary DB manipulation and possible RCE	CWE-89, CWE-288
model	query param	admin/ajax.php	SQL injection via unsafely handled brand parameter in FreePBX endpoint AJAX call leading to arbitrary DB manipulation and possible RCE	CWE-89, CWE-288
brand	query param	admin/ajax.php	SQL injection via unsafely handled brand parameter in FreePBX endpoint AJAX call leading to arbitrary DB manipulation and possible RCE	CWE-89, CWE-288

17 Jun 2026 15:45Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

CVSS 410

EPSS0.85463

SSVC

unauthenticated access sql injection remote code execution freepbx versions patched versions