There's a bug in FreePBX that lets someone walk in without a login, drop a cron job, and get a shell on your server. No username. No password. Just a web request.

It's CVE-2025-57819. Jared Brits found it. You might know him as K3ysTr0K3R. He published a working exploit. CVSS gives it a 9.8. CISA put it in their known exploited list. That's not a drill.

If you run FreePBX, patch today. Not tomorrow. Today.

The Short Version

What Is FreePBX?

It's an open-source phone system. Built on Asterisk. Businesses use it for extensions, voicemail, call routing. Standard office phone stuff.

There's a module called Endpoint Manager. It handles phone configuration. That's where the bug is.

The Bug

The brand parameter in /admin/ajax.php goes straight into a SQL query. No filtering. No escaping. Nothing.

That's an SQL injection. Normally that means someone can read your database. Bad, but not catastrophic. But FreePBX allows stacked queries. That means you can chain multiple SQL statements together with semicolons.

So an attacker can do this:

1. Send a request with a nasty brand value
2. Chain an INSERT statement onto the query
3. Add a cron job to the database
4. The cron job runs a reverse shell
5. The shell calls home
6. No login. Just a GET request.

How the Exploit Works

The researcher's script handles everything. Here's the flow:

First, it determines whether the target is vulnerable. It probes the target causing it to produce a database error with the username. The presence of "freepbxuser" in the response shows that the target is exploitable.

Second, it creates a listener on the attacker's machine. It waits for the target to establish connection to it.

Third, it executes the payload. The SQL statement inserts a new row in the cron_jobs table. The command is a base64-encoded reverse shell. Clean and simple.

Then, it waits. Cron runs every minute. Within 60 seconds, the target calls back.

Finally, it upgrades the shell to a full PTY using Python. That gives you tab completion, job control, the works.

The whole thing takes a couple of minutes.

Why This Is So Bad

Let me count the reasons.

• No credentials. None. You don't need an account. You don't need a password. You just need to reach the admin interface.
• The shell runs as the web user. Usually Apache or www-data. That's enough to read config files, hit the database, and move laterally.
• CISA added it to KEV. That means it's being used right now. People are getting hit.
• Stacked queries are on. That's the difference between "someone can read my database" and "someone owns my server." Without stacked queries, you can't insert a cron job. With them, you can.

Which Versions Are Affected?

Old versions? Probably vulnerable too. Just update.

What You Should Do

• Update FreePBX. Go to module admin. Update Endpoint Manager. Or run the update from the command line. The fixed versions are above.
• Check for weird cron jobs. Look in the cron_jobs table. Look at the actual crontab. If you see something you didn't add, that's bad.
• Check for outbound connections. A reverse shell calls out. Look at your firewall logs. Look at netstat.
• Lock down the admin interface. It should not be on the internet. Put it behind a VPN. Restrict by IP. Use a firewall. This is basic stuff, but people skip it.
• Check your logs. Look for requests to /admin/ajax.php with sketchy brand parameters. SQL injection payloads often show up in access logs.
• If you think you got hit, assume the worst. Rotate every credential. Look for backdoors. Consider rebuilding the box. Once someone has a shell, you can't trust anything on that system.

The Bottom Line

FreePBX has a bug. No login needed. Just a web request. And you get a shell. Patch to 15.0.66, 16.0.89, or 17.0.3. Check for compromise. Lock down your admin interface.

Quick Reference:

What to Do:

1. Update now
2. Check cron jobs
3. Lock down admin access
4. Check logs for exploitation
5. Assume compromise if you see anything weird

FAQ Section

What is CVE-2025-57819?

An unauthenticated SQL injection in FreePBX's Endpoint Manager. Attackers inject a cron job that runs a reverse shell. Full remote code execution. No login needed.

How does it work?

The brand parameter in /admin/ajax.php goes into a SQL query without filtering. Attackers chain an INSERT statement to add a cron job. The cron job runs a reverse shell.

Which versions are affected?

15.x before 15.0.66, 16.x before 16.0.89, and 17.x before 17.0.3.

Do I need an account to exploit this?

No. It's unauthenticated. Anyone who can reach the admin interface can exploit it.

Is it being exploited?

Yes. It's in CISA's Known Exploited Vulnerabilities catalog.

What should I do?

Update. Check for weird cron jobs. Lock down the admin interface. Check your logs.

Source: Exploit DB