CVE-2025-57819

🗓️ 28 Aug 2025 16:45:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 44 Media mentions👁 907 Views🌐 WEB

Unauthenticated access enables SQL injection and remote code execution in FreePBX.

Reporter	Title	Published	Views	Family All 92
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Sep 202515:28	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	7 Jun 202600:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	5 Oct 202615:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Jun 202610:22	–	githubexploit
GithubExploit	Exploit for CVE-2025-57819	29 Aug 202511:59	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	4 Sep 202503:21	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	6 Sep 202620:32	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	18 Sep 202520:38	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Oct 202614:11	–	githubexploit
GithubExploit	security-research	9 Jul 202615:08	–	githubexploit

NVD

Vulners

Node

sangoma freepbxRange15.0–15.0.66

sangoma freepbxRange16.0–16.0.89

sangoma freepbxRange17.0–17.0.3

[
  {
    "vendor": "FreePBX",
    "product": "endpoint",
    "versions": [
      {
        "version": "< 15.0.66",
        "status": "affected"
      },
      {
        "version": "< 16.0.89",
        "status": "affected"
      },
      {
        "version": "< 17.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
community	www.community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

Parameter	Position	Path	Description	CWE
brand	query param	/admin/ajax.php	SQL injection in FreePBX endpoint via the admin/ajax.php interface using the brand parameter to manipulate the database and enable remote code execution.	CWE-288, CWE-89

26 Sep 2026 00:10Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

CVSS 410

EPSS0.95024

SSVC

unauthenticated access sql injection remote code execution freepbx versions patched versions