rxerium/FreePBX-Vulns-December-25

GitHubRepository PoCScanner

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a set of Nuclei templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. It does not contain exploit code.

Backdoor review

No backdoor observed in reviewed code

The repository contains three Nuclei templates and a README for detecting known FreePBX vulnerabilities (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039). The templates perform only version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesyamlmarkdown
Target softwareFreePBX
Attack typesdetectionversion fingerprinting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The templates only perform version detection and matching; they do not send any payloads to trigger SQL injection, file upload, or authentication bypass. The README confirms the detection is non-invasive and does not attempt exploitation.

CVE-2025-61675.yaml:24-52README.md:26

Requirements

  • Target must expose the FreePBX administration panel at /admin/config.php.CVE-2025-61675.yaml:26
  • Nuclei scanner must be installed to execute the templates.README.md:31

Observed behavior

  • Sends a GET request to /admin/config.php to retrieve the page body.CVE-2025-61675.yaml:24-26
  • Extracts the FreePBX version string using a regex.CVE-2025-61675.yaml:28-34
  • Matches the response status (200) and body content (FreePBX Administration, Operator Panel, User Control Panel).CVE-2025-61675.yaml:36-48
  • Compares the extracted version against vulnerable version ranges using DSL.CVE-2025-61675.yaml:50-52
  • README explicitly states the detection is non-invasive and does not attempt exploitation.README.md:26
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-61675.yamlTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-61675.yaml:24-52
Nuclei Template
CVE-2025-61678.yamlTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-61678.yaml:24-52
Nuclei Template
CVE-2025-66039.yamlTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-66039.yaml:24-52
Contact Information
Signal and Twitter/X links in README.mdAuthor contact information is present but does not constitute backdoor behavior.README.md:76-78
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the text content; its absence does not affect classification as it is not a code or behavior file.
  • The evidence does not include any exploit payloads or proof of exploitation; classification is based solely on the provided scanner templates and documentation.
  • One file (LICENSE) was omitted from the text evidence; its content was not reviewed.
  • Binary content was not present in the evidence packet.
  • The review is limited to the supplied text evidence and does not assess the safety of external links or the Nuclei framework itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

3