Noah King
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
MetasploitFreePBX endpoint SQLi to RCE
Metasploit exploitby msutovsky-r7Added to Metasploit 2026-01-15ExploitCVE-2025-61675CVE-2025-660391 file
Analysis
Technical assessment
Metasploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve unauthenticated remote code execution on FreePBX by injecting a malicious cron job.
Backdoor review
No backdoor observed in reviewed code
The module exploits CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve remote code execution on FreePBX. It sends crafted HTTP requests to inject a cron job entry, waits for execution, and cleans up the injected job. No backdoor, deceptive payload, or concealed operator-directed harm is present; the behavior is consistent with a standard Metasploit exploit module.
Classification basis and observed behavior
Classification basis
The module's exploit method constructs and sends a SQL injection payload that inserts a command into the cron_jobs table, leading to remote code execution. This is active exploitation, not just detection.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:95-108Requirements
- Target must be running a vulnerable version of FreePBX (before 16.0.44/17.0.23 for auth bypass, before 16.0.92/17.0.6 for SQLi) with Webserver Authorization Mode enabled.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-21 - A valid FreePBX username must be supplied by the attacker.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:64
Observed behavior
- Sends a POST request to /admin/config.php with a forged Authorization header (using the supplied username and a random password) to bypass authentication.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:70-83 - Injects a SQL payload into the 'id' parameter to insert a new record into the cron_jobs table, containing the attacker's command payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-101 - The injected cron job is executed by the operating system, delivering a reverse shell or other command payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:23-25 - Attempts to clean up by deleting the injected cron job after exploitation.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:111-126
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe module chains two CVEs to gain unauthenticated SQL injection and then injects a cron job that executes the attacker's payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-25 - Payload Execution
- Payload withheldThe exploit constructs an INSERT statement that places the Metasploit payload into a cron job, which FreePBX executes on the OS.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-99 - Cleanup
- Payload withheldThe cleanup method removes the injected cron job to reduce artifacts on the target.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:117
What the analysis did not establish
- Only the module source code and metadata were analyzed; Metasploit framework mixins, libraries, and external payloads were not expanded or inspected.
- The analysis is based solely on static code review; the code was not executed, and its behavior was not verified against a live target.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
- The review does not assess the safety or reliability of the default payload (cmd/linux/http/x64/meterpreter/reverse_tcp) or any user-selected payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitFreePBX Custom Extension SQL Injection
Metasploit auxiliary PoCby msutovsky-r7Added to Metasploit 2026-01-15ExploitCVE-2025-61675CVE-2025-660391 file
Analysis
Technical assessment
This Metasploit auxiliary module chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to perform an unauthenticated SQL injection attack that creates a new administrative user in FreePBX.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to create a new administrative user on vulnerable FreePBX instances. All behavior is consistent with the stated exploit purpose. No concealed executable payloads, persistence mechanisms, credential exfiltration to external systems, or unrelated remote access are present.
Classification basis and observed behavior
Classification basis
The module's run method executes a SQL injection payload that inserts a new administrative user into the database, which is an active exploitation action, not merely detection or scanning.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:69-82modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111Requirements
- Target FreePBX instance must have Webserver Authorization Mode enabled for the authentication bypass (CVE-2025-66039).
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16 - Target FreePBX version must be vulnerable to CVE-2025-61675 (SQL injection in custom extension component).
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16
Observed behavior
- Sends a POST request to /admin/config.php with a forged Authorization header (using an arbitrary password) to bypass authentication.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:44-57 - Injects a SQL payload via the 'id' POST parameter to insert a new administrative user into the ampusers table.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111 - Validates the newly created administrative user by attempting to authenticate via /admin/ajax.php.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:85-108
Behaviors behind the backdoor verdict
Observables
- Sql Injection Payload
- Payload withheldThe SQL injection payload inserts a new administrative user into the ampusers table, which aligns with the module's described goal of creating an admin account.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:111 - Authentication Bypass
- Payload withheldThe module uses the CVE-2025-66039 authentication bypass by sending a Basic Authorization header with the target username and a random password, as described in the module metadata.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:48 - Credential Validation
- Payload withheldAfter creating the user, the module validates the new admin credentials by making a legitimate API call to the FreePBX admin interface. This is normal post-exploitation verification.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:86-99
What the analysis did not establish
- Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior and effectiveness are not verified; classification is based on the code's stated purpose and logic.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and any external payloads were not expanded or analyzed.
- Binary files were not inspected; the evidence policy flagged them as metadata-only, but no binary files were present in this artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitFreePBX firmware file upload
Metasploit exploitby msutovsky-r7Added to Metasploit 2026-01-09ExploitCVE-2025-61678CVE-2025-660391 file
Analysis
Technical assessment
A Metasploit exploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61678 (authenticated arbitrary file upload) to achieve unauthenticated remote code execution on FreePBX by uploading a PHP webshell.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2025-66039 and CVE-2025-61678. It performs authentication bypass and file upload to deliver a user-chosen payload. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that chains two CVEs to bypass authentication, upload a PHP webshell, and execute it for remote code execution. It includes check, auth bypass, upload, and trigger methods, and is classified as 'exploit' in its own metadata.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:6modules/exploits/unix/http/freepbx_firmware_file_upload.rb:126-137Requirements
- FreePBX target with Webserver Authorization Mode enabled and vulnerable versions (prior to 16.0.44/17.0.23 for auth bypass; prior to 16.0.92/17.0.6 for file upload).
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:18 - A valid FreePBX username must be supplied via the USERNAME option.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:54
Observed behavior
- Sends a GET request to /admin/config.php to check if the target returns a 401 with 'FreePBX' in the body or a 500, indicating Webserver authentication mode is active.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:60-68 - Bypasses authentication by sending a GET request to /admin/config.php with a forged Authorization header containing the supplied username and a random password, then extracts the session cookie from the 401 response.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:73-84 - Uploads a PHP payload via a multipart POST request to /admin/ajax.php?module=endpoint&command=upload_cust_fw, using path traversal in the fwbrand parameter to place the webshell in a web-accessible directory.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:86-117 - Triggers the uploaded PHP payload by sending a GET request to the webshell's URL.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:119-124
Behaviors behind the backdoor verdict
Observables
- Payload Delivery
- Payload withheldThe module uploads and executes a user-supplied payload, which is standard exploit behavior.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:94-101 - Authentication Bypass
- Payload withheldThe module uses a forged Authorization header to bypass authentication, consistent with CVE-2025-66039.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:77 - Path Traversal
- Payload withheldThe module uses path traversal in the fwbrand parameter to place the webshell in the web root, consistent with CVE-2025-61678.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:98
What the analysis did not establish
- Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of payload withheld and helper methods (e.g., basic_auth, send_request_cgi) is not visible.
- The evidence does not include any runtime output, network captures, or verification that the exploit succeeds against a live target.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were flagged as metadata-only and not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.