FreePBX Endpoint Manager Unauthenticated Remote Code Execution

FreePBX is vulnerable to a critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-57819, affecting versions prior to 15.0.66, 16.0.89, and 17.0.3. The vulnerability resides in the Endpoint Manager module's 'brand' parameter within the '/admin/ajax.php' endpoint. Because the application fails to properly sanitize user input before incorporating it into SQL queries, an unauthenticated attacker can perform stacked SQL injection attacks. By leveraging this flaw, an attacker can insert arbitrary entries into the 'cron_jobs' table of the underlying database. These entries are periodically executed by the system's cron daemon with administrative privileges, typically as the Apache web server user, resulting in full remote code execution on the server. The availability of weaponized exploit code in the public domain necessitates immediate patching.

Attack Chain

1. The attacker identifies an internet-facing FreePBX server running a vulnerable version of the Endpoint Manager module.
2. The attacker sends a crafted GET request to '/admin/ajax.php' targeting the 'brand' parameter.
3. The crafted input performs SQL injection to bypass authentication or validation routines using stacked queries.
4. The attacker executes a SQL 'INSERT' statement to add a new task to the 'cron_jobs' table.
5. The injected command is configured as a reverse shell payload encoded in base64.
6. The system's cron daemon processes the malicious entry within approximately 60 seconds.
7. The system executes the base64-decoded bash command with the privileges of the web server user.
8. A reverse shell is established, granting the attacker interactive command execution on the host.

Impact

Successful exploitation of CVE-2025-57819 leads to complete server compromise. As the malicious cron job executes with the privileges of the web server user, attackers can gain persistent access, exfiltrate sensitive configuration data, or pivot into the internal network where the FreePBX instance is hosted. This vulnerability is reported to be included in CISA's Known Exploited Vulnerabilities catalog.

Recommendation

Prioritized actions for security teams:

• Patch all affected FreePBX instances immediately: update to 15.0.66, 16.0.89, 17.0.3, or later versions.
• Deploy the provided Sigma rule to monitor for suspicious requests to '/admin/ajax.php' containing SQL injection patterns.
• Audit the 'cron_jobs' table in the FreePBX database for any unauthorized or suspicious command entries.
• Restrict access to the FreePBX web management interface to trusted internal networks via firewall rules to mitigate exploitation attempts.