FreePBX endpoint SQLi to RCE
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Metasploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve unauthenticated remote code execution on FreePBX by injecting a malicious cron job.
Backdoor review
No backdoor observed in reviewed code
The module exploits CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve remote code execution on FreePBX. It sends crafted HTTP requests to inject a cron job entry, waits for execution, and cleans up the injected job. No backdoor, deceptive payload, or concealed operator-directed harm is present; the behavior is consistent with a standard Metasploit exploit module.
Classification basis and observed behavior
Classification basis
The module's exploit method constructs and sends a SQL injection payload that inserts a command into the cron_jobs table, leading to remote code execution. This is active exploitation, not just detection.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:95-108Requirements
- Target must be running a vulnerable version of FreePBX (before 16.0.44/17.0.23 for auth bypass, before 16.0.92/17.0.6 for SQLi) with Webserver Authorization Mode enabled.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-21 - A valid FreePBX username must be supplied by the attacker.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:64
Observed behavior
- Sends a POST request to /admin/config.php with a forged Authorization header (using the supplied username and a random password) to bypass authentication.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:70-83 - Injects a SQL payload into the 'id' parameter to insert a new record into the cron_jobs table, containing the attacker's command payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-101 - The injected cron job is executed by the operating system, delivering a reverse shell or other command payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:23-25 - Attempts to clean up by deleting the injected cron job after exploitation.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:111-126
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Authentication bypass (CVE-2025-66039) + SQL injection (CVE-2025-61675) -> cron job injection -> RCEThe module chains two CVEs to gain unauthenticated SQL injection and then injects a cron job that executes the attacker's payload.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-25 - Payload Execution
- payload.encoded inserted into cron_jobs table command columnThe exploit constructs an INSERT statement that places the Metasploit payload into a cron job, which FreePBX executes on the OS.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-99 - Cleanup
- DELETE FROM cron_jobs WHERE jobname='...'The cleanup method removes the injected cron job to reduce artifacts on the target.
modules/exploits/unix/http/freepbx_custom_extension_rce.rb:117
What the analysis did not establish
- Only the module source code and metadata were analyzed; Metasploit framework mixins, libraries, and external payloads were not expanded or inspected.
- The analysis is based solely on static code review; the code was not executed, and its behavior was not verified against a live target.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
- The review does not assess the safety or reliability of the default payload (cmd/linux/http/x64/meterpreter/reverse_tcp) or any user-selected payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.