cyberleelawat/FreePBX-Multiple-CVEs-2025
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact contains three Nuclei YAML templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. The templates do not send exploit payloads; they only perform version fingerprinting and matching.
Backdoor review
No backdoor observed in reviewed code
The repository contains three Nuclei YAML templates and a README for detecting known FreePBX vulnerabilities. The templates perform only non-invasive version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
All three YAML templates only extract the FreePBX version and compare it against known vulnerable ranges; they do not send any SQL injection, file upload, or authentication bypass payloads. The README explicitly states the detection is non-invasive and does not attempt exploitation. This is consistent with a vulnerability scanner, not an exploit.
CVE-2025-61675.yaml:24-52CVE-2025-61678.yaml:24-52CVE-2025-66039.yaml:24-52README.md:42Requirements
- Target must expose the FreePBX administration panel at /admin/config.php.
CVE-2025-61675.yaml:25-26 - Nuclei engine must be installed to execute the templates.
README.md:149-150
Observed behavior
- Sends a GET request to /admin/config.php and extracts the FreePBX version using a regex.
CVE-2025-61675.yaml:24-34 - Matches the response body for FreePBX-specific strings and a 200 status code.
CVE-2025-61675.yaml:36-48 - Compares the extracted version against vulnerable version ranges using a DSL expression.
CVE-2025-61675.yaml:50-52 - README states the detection is non-invasive and does not attempt to exploit the vulnerabilities.
README.md:42
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- CVE-2025-61675.yamlTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No exploit payload is sent.
CVE-2025-61675.yaml:24-52 - Nuclei Template
- CVE-2025-61678.yamlTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No file upload or shell payload is present.
CVE-2025-61678.yaml:24-52 - Nuclei Template
- CVE-2025-66039.yamlTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No forged Authorization header or authentication bypass attempt is made.
CVE-2025-66039.yaml:24-52 - Repository Metadata
- Author: rxerium / Virendra Kumar, Organization: Cyber LeelawatREADME identifies the author and organization. This is standard metadata and does not indicate backdoor behavior.
README.md:200-202
What the analysis did not establish
- One text file (likely an image) was omitted from the packet; its content is not available for analysis.
- The templates are not executed; classification is based solely on static analysis of the provided YAML and README content.
- One file (unclassified, 35149 bytes) was not analyzed because it was flagged as binary/metadata-only; its content is unknown.
- The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.