FreePBX Custom Extension SQL Injection
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
This Metasploit auxiliary module chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to perform an unauthenticated SQL injection attack that creates a new administrative user in FreePBX.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to create a new administrative user on vulnerable FreePBX instances. All behavior is consistent with the stated exploit purpose. No concealed executable payloads, persistence mechanisms, credential exfiltration to external systems, or unrelated remote access are present.
Classification basis and observed behavior
Classification basis
The module's run method executes a SQL injection payload that inserts a new administrative user into the database, which is an active exploitation action, not merely detection or scanning.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:69-82modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111Requirements
- Target FreePBX instance must have Webserver Authorization Mode enabled for the authentication bypass (CVE-2025-66039).
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16 - Target FreePBX version must be vulnerable to CVE-2025-61675 (SQL injection in custom extension component).
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16
Observed behavior
- Sends a POST request to /admin/config.php with a forged Authorization header (using an arbitrary password) to bypass authentication.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:44-57 - Injects a SQL payload via the 'id' POST parameter to insert a new administrative user into the ampusers table.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111 - Validates the newly created administrative user by attempting to authenticate via /admin/ajax.php.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:85-108
Behaviors behind the backdoor verdict
Observables
- Sql Injection Payload
- 1';INSERT INTO ampusers (username, password_sha1, sections) VALUES ('#{username}', '#{password_digest}', '*')#The SQL injection payload inserts a new administrative user into the ampusers table, which aligns with the module's described goal of creating an admin account.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:111 - Authentication Bypass
- Authorization header with arbitrary passwordThe module uses the CVE-2025-66039 authentication bypass by sending a Basic Authorization header with the target username and a random password, as described in the module metadata.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:48 - Credential Validation
- POST to admin/ajax.php with module=userman&command=checkPasswordReminderAfter creating the user, the module validates the new admin credentials by making a legitimate API call to the FreePBX admin interface. This is normal post-exploitation verification.
modules/auxiliary/gather/freepbx_custom_extension_injection.rb:86-99
What the analysis did not establish
- Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior and effectiveness are not verified; classification is based on the code's stated purpose and logic.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and any external payloads were not expanded or analyzed.
- Binary files were not inspected; the evidence policy flagged them as metadata-only, but no binary files were present in this artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.