freepbx-endpoint-sqli-rce

CVE-2025-57819 — Injection SQL du module Endpoint FreePBX → Exécution de code à distance Résumé FreePBX est l'interface graphique web open-source d'Asterisk PBX, largement déployée dans les environnements téléphoniques d'entreprise. Le module Endpoint Manager expose un gestionnaire AJAX à l'adres...

CVE-2025-57819-poc

CVE-2025-57819 — FreePBX SQLi non authentifiée → RCE Exploit one-shot pour l'injection SQL non authentifiée du Endpoint Manager de FreePBX CVE-2025-57819, chaînée en exécution de code à distance via la table cronjobs de FreePBX. Réservé aux tests de sécurité autorisés / CTF. Vulnérabilité Le...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — SQLi non authentifié à RCE racine Sévérité: Critique Type: Injection SQL non authentifiée → Exécution de code à distance Logiciel concerné: FreePBX module endpoint Testé sur: FreePBX sous CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Aperçu Une vulnérabilité d'injection SQL...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX: неаутентифицированный SQLi до RCE Универсальный эксплойт для CVE-2025-57819 , неаутентифицированная SQL-инъекция в модуле endpoint FreePBX, которая приводит к удаленному выполнению кода через внедрение задачи cron. CVSS : 9.8 Критический —...

cve-2025-57819-exploit

Exploit CVE-2025-57819 Métadonnées Sévérité : Critique 9.8 Vecteur : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type : Injection SQL non authentifiée → Exécution de code à distance Logiciels concernés : FreePBX module endpoint 15.0.66, 16.0.89 et 17.0.3 Testé sur : FreePBX 16.0.40.7 sur CentOS ...

cve-2025-5781_FreePBX

cve-2025-5781FreePBX En août 2025, une vulnérabilité critique a été divulguée dans le module Endpoint de FreePBX. CVE-2025–57819 permet à un attaquant non authentifié d'exploiter une injection SQL dans le module Endpoint et, via une chaîne de manipulation de base de données et d'exécution de tâch...

Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 Exploit Metadata - Severity: Critical...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

CVE-2025-57819 — FreePBX Pre-Auth SQLi to RCE An all-in-one e...

📄 FreePBX Endpoint Authentication Bypass / SQL Injection

This proof of concept exploit demonstrates a chained attack scenario in FreePBX that combines an authentication bypass with a SQL injection vulnerability in the custom endpoint extension component. When specific configuration conditions are met, an attacker may interact with administrative...

VulnCheck KEV: CVE-2025-64328

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the...

CVE-2025-67513

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the apppassword parameter. Depending on local...

CVE-2025-67513

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the apppassword parameter. Depending on local...

CVE-2025-67513 FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the apppassword parameter. Depending on local...

CVE-2025-67513 FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the apppassword parameter. Depending on local...

CVE-2025-67513

CVE-2025-67513 affects FreePBX Endpoint Manager (module for managing telephony endpoints in FreePBX). Versions prior to 16.0.96 and 17.0.1 through 17.0.9 use a weak default 6‑digit app_password, which can be brute-forced. Depending on local configuration, this password could grant access to the e...

EUVD-2025-202640

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the apppassword parameter. Depending on local...

CVE-2025-66039

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target us...

FreePBX Endpoint Manager 安全漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from the FreePBX open source. A security vulnerability exists in FreePBX Endpoint Manager versions prior to 16.0.96 and 17.0.1 through 17.0.9, which stems from a weak default password that can be brute-force broken...

PT-2025-50554

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. This is the app password parameter. Depending on local...

FreePBX SQL Injection Vulnerability (CNVD-2025-3038208)

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. FreePBX suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered S...