CVE-2025-66039: FreePBX Endpoint Manager Allows…

Record summary

CVE-2025-66039 has a selected CVSS score of 9.3 (critical); EIP currently links 3 catalogued exploits and 3 repository PoCs.

Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits: 3
Repository PoCs: 3

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 17, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
framework Browse FreePBX / framework	CVE List	< 16.0.44	affected
framework Browse FreePBX / framework	CVE List	>= 17.0.1, < 17.0.23	affected

Proofs of concept

Catalogued exploits

MetasploitFreePBX Custom Extension SQL InjectionMetasploit auxiliary PoCby Noah King +1 moreExploit1 file

Ruby · linked to 2 vulnerabilities

Metasploit

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

This Metasploit auxiliary module chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to perform an unauthenticated SQL injection attack that creates a new administrative user in FreePBX.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to create a new administrative user on vulnerable FreePBX instances. All behavior is consistent with the stated exploit purpose. No concealed executable payloads, persistence mechanisms, credential exfiltration to external systems, or unrelated remote access are present.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagesruby

Target softwareFreePBX

Attack typesauthentication bypasssql injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module's run method executes a SQL injection payload that inserts a new administrative user into the database, which is an active exploitation action, not merely detection or scanning.

modules/auxiliary/gather/freepbx_custom_extension_injection.rb:69-82modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111

Requirements

Target FreePBX instance must have Webserver Authorization Mode enabled for the authentication bypass (CVE-2025-66039).modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16
Target FreePBX version must be vulnerable to CVE-2025-61675 (SQL injection in custom extension component).modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16

Observed behavior

Sends a POST request to /admin/config.php with a forged Authorization header (using an arbitrary password) to bypass authentication.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:44-57
Injects a SQL payload via the 'id' POST parameter to insert a new administrative user into the ampusers table.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111
Validates the newly created administrative user by attempting to authenticate via /admin/ajax.php.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:85-108

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Sql Injection Payload: Payload withheldThe SQL injection payload inserts a new administrative user into the ampusers table, which aligns with the module's described goal of creating an admin account.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:111
Authentication Bypass: Payload withheldThe module uses the CVE-2025-66039 authentication bypass by sending a Basic Authorization header with the target username and a random password, as described in the module metadata.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:48
Credential Validation: Payload withheldAfter creating the user, the module validates the new admin credentials by making a legitimate API call to the FreePBX admin interface. This is normal post-exploitation verification.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:86-99

Review boundaries

What the analysis did not establish

Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
The module's actual runtime behavior and effectiveness are not verified; classification is based on the code's stated purpose and logic.
Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and any external payloads were not expanded or analyzed.
Binary files were not inspected; the evidence policy flagged them as metadata-only, but no binary files were present in this artifact.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

MetasploitFreePBX endpoint SQLi to RCEMetasploit exploitby Noah King +1 moreExploit1 file

Ruby · linked to 2 vulnerabilities

Metasploit

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

Metasploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve unauthenticated remote code execution on FreePBX by injecting a malicious cron job.

Backdoor review

No backdoor observed in reviewed code

The module exploits CVE-2025-66039 (authentication bypass) and CVE-2025-61675 (SQL injection) to achieve remote code execution on FreePBX. It sends crafted HTTP requests to inject a cron job entry, waits for execution, and cleans up the injected job. No backdoor, deceptive payload, or concealed operator-directed harm is present; the behavior is consistent with a standard Metasploit exploit module.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareFreePBX

Attack typesauthentication bypasssql injectionremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method constructs and sends a SQL injection payload that inserts a command into the cron_jobs table, leading to remote code execution. This is active exploitation, not just detection.

modules/exploits/unix/http/freepbx_custom_extension_rce.rb:95-108

Requirements

Target must be running a vulnerable version of FreePBX (before 16.0.44/17.0.23 for auth bypass, before 16.0.92/17.0.6 for SQLi) with Webserver Authorization Mode enabled.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-21
A valid FreePBX username must be supplied by the attacker.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:64

Observed behavior

Sends a POST request to /admin/config.php with a forged Authorization header (using the supplied username and a random password) to bypass authentication.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:70-83
Injects a SQL payload into the 'id' parameter to insert a new record into the cron_jobs table, containing the attacker's command payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-101
The injected cron job is executed by the operating system, delivering a reverse shell or other command payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:23-25
Attempts to clean up by deleting the injected cron job after exploitation.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:111-126

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain: Payload withheldThe module chains two CVEs to gain unauthenticated SQL injection and then injects a cron job that executes the attacker's payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-25
Payload Execution: Payload withheldThe exploit constructs an INSERT statement that places the Metasploit payload into a cron job, which FreePBX executes on the OS.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-99
Cleanup: Payload withheldThe cleanup method removes the injected cron job to reduce artifacts on the target.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:117

Review boundaries

What the analysis did not establish

Only the module source code and metadata were analyzed; Metasploit framework mixins, libraries, and external payloads were not expanded or inspected.
The analysis is based solely on static code review; the code was not executed, and its behavior was not verified against a live target.
Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
The review does not assess the safety or reliability of the default payload (cmd/linux/http/x64/meterpreter/reverse_tcp) or any user-selected payload.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

MetasploitFreePBX firmware file uploadMetasploit exploitby Noah King +1 moreExploit1 file

Ruby · linked to 2 vulnerabilities

Metasploit

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Metasploit exploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61678 (authenticated arbitrary file upload) to achieve unauthenticated remote code execution on FreePBX by uploading a PHP webshell.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-66039 and CVE-2025-61678. It performs authentication bypass and file upload to deliver a user-chosen payload. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesRuby

Target softwareFreePBX

Attack typesauthentication bypassarbitrary file uploadpath traversalremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that chains two CVEs to bypass authentication, upload a PHP webshell, and execute it for remote code execution. It includes check, auth bypass, upload, and trigger methods, and is classified as 'exploit' in its own metadata.

modules/exploits/unix/http/freepbx_firmware_file_upload.rb:6modules/exploits/unix/http/freepbx_firmware_file_upload.rb:126-137

Requirements

FreePBX target with Webserver Authorization Mode enabled and vulnerable versions (prior to 16.0.44/17.0.23 for auth bypass; prior to 16.0.92/17.0.6 for file upload).modules/exploits/unix/http/freepbx_firmware_file_upload.rb:18
A valid FreePBX username must be supplied via the USERNAME option.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:54

Observed behavior

Sends a GET request to /admin/config.php to check if the target returns a 401 with 'FreePBX' in the body or a 500, indicating Webserver authentication mode is active.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:60-68
Bypasses authentication by sending a GET request to /admin/config.php with a forged Authorization header containing the supplied username and a random password, then extracts the session cookie from the 401 response.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:73-84
Uploads a PHP payload via a multipart POST request to /admin/ajax.php?module=endpoint&command=upload_cust_fw, using path traversal in the fwbrand parameter to place the webshell in a web-accessible directory.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:86-117
Triggers the uploaded PHP payload by sending a GET request to the webshell's URL.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:119-124

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Delivery: Payload withheldThe module uploads and executes a user-supplied payload, which is standard exploit behavior.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:94-101
Authentication Bypass: Payload withheldThe module uses a forged Authorization header to bypass authentication, consistent with CVE-2025-66039.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:77
Path Traversal: Payload withheldThe module uses path traversal in the fwbrand parameter to place the webshell in the web root, consistent with CVE-2025-61678.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:98

Review boundaries

What the analysis did not establish

Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of payload withheld and helper methods (e.g., basic_auth, send_request_cgi) is not visible.
The evidence does not include any runtime output, network captures, or verification that the exploit succeeds against a live target.
Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
Binary files were flagged as metadata-only and not inspected.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubBimBoxH4/CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBXRepository PoCby BimBoxH41Exploit3 files

34.1 KiB · linked to 3 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Python-based tool that performs authenticated SQL injection exploitation (CVE-2025-61675) by inserting a new administrative user into the database, and attempts authenticated arbitrary file upload (CVE-2025-61678) leading to remote code execution via a PHP webshell. It also includes an authentication bypass check (CVE-2025-66039) to obtain a session cookie.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based vulnerability scanner for FreePBX systems targeting CVE-2025-66039, CVE-2025-61675, and CVE-2025-61678. The code performs authentication bypass via PHPSESSID extraction, file upload testing, and SQL injection detection/exploitation. All behavior is consistent with the stated purpose of a security assessment tool. No concealed backdoor, unrelated remote access, persistence mechanisms, or deceptive payloads were observed.

ClassificationExploit

Model confidence95%

AuthenticationRequired

Languagespython

Target softwareFreePBXFreePBX Endpoint Manager

Attack typessql injectionarbitrary file uploadauthentication bypass

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to exploit vulnerabilities, not just detect them. The 'exploit_sql_injection' function executes an INSERT statement to add a new user to the database, and the 'upload_exploit' function uploads a PHP webshell to achieve remote code execution. The README and code comments refer to the tool as an 'Exploitation Tool'.

exploit.py:388-465exploit.py:160-227README.md:34

Requirements

Target must be running a vulnerable version of FreePBX with the Endpoint Manager module.README.md:23-25
For SQL injection and file upload, authentication is required. The tool attempts to bypass authentication using a hardcoded Authorization header.exploit.py:115-119

Observed behavior

Sends an HTTP GET request with a hardcoded Basic Authorization header to /admin/config.php to extract a PHPSESSID cookie, exploiting CVE-2025-66039.exploit.py:109-133
Constructs and sends a multipart/form-data POST request to /admin/ajax.php to upload a PHP file (text1.php) containing a simple echo statement, using a path traversal in the 'fwbrand' parameter to place it in the web root.exploit.py:160-227
Verifies the uploaded PHP file by sending a GET request to the target URL and checking for the expected random string in the response.exploit.py:256-284
Sends POST requests with SQL injection payloads to multiple endpoints (basestation, firmware, basefile, customExt) to detect SQL injection vulnerabilities.exploit.py:354-386
Exploits a confirmed SQL injection vulnerability by sending a crafted POST request to the customExt endpoint that executes an INSERT statement to add a new administrative user ('textuser') to the 'ampusers' table.exploit.py:388-465

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Injection: Payload withheldHardcoded credentials injected via SQL exploit for testing purposes, consistent with PoC demonstration.exploit.py:403-404
File Upload Payload: Payload withheldUploads a simple PHP file to verify file upload vulnerability; no malicious webshell or backdoor code.exploit.py:168-226
Authentication Bypass: Payload withheldUses hardcoded Authorization header to bypass webserver authentication, matching CVE-2025-66039 description.exploit.py:115-118

Review boundaries

What the analysis did not establish

Evidence is limited to the source code and README; no runtime output or network captures are provided to confirm the exploit's effectiveness.
The analysis scope indicates 'complete_artifact_coverage: false' for the packet, meaning not all files from the repository may be present, though all selected text files are complete.
No binary files were present in the artifact.
The review is limited to the supplied text files; no runtime behavior or network traffic was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubrxerium/FreePBX-Vulns-December-25Repository PoCby rxerium48Scanner5 files

9.0 KiB · linked to 3 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

The artifact is a set of Nuclei templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. It does not contain exploit code.

Backdoor review

No backdoor observed in reviewed code

The repository contains three Nuclei templates and a README for detecting known FreePBX vulnerabilities (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039). The templates perform only version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.

ClassificationScanner

Model confidence98%

AuthenticationNot required

Languagesyamlmarkdown

Target softwareFreePBX

Attack typesdetectionversion fingerprinting

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The templates only perform version detection and matching; they do not send any payloads to trigger SQL injection, file upload, or authentication bypass. The README confirms the detection is non-invasive and does not attempt exploitation.

CVE-2025-61675.yaml:24-52README.md:26

Requirements

Target must expose the FreePBX administration panel at /admin/config.php.CVE-2025-61675.yaml:26
Nuclei scanner must be installed to execute the templates.README.md:31

Observed behavior

Sends a GET request to /admin/config.php to retrieve the page body.CVE-2025-61675.yaml:24-26
Extracts the FreePBX version string using a regex.CVE-2025-61675.yaml:28-34
Matches the response status (200) and body content (FreePBX Administration, Operator Panel, User Control Panel).CVE-2025-61675.yaml:36-48
Compares the extracted version against vulnerable version ranges using DSL.CVE-2025-61675.yaml:50-52
README explicitly states the detection is non-invasive and does not attempt exploitation.README.md:26

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template: Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-61675.yaml:24-52
Nuclei Template: Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-61678.yaml:24-52
Nuclei Template: Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.CVE-2025-66039.yaml:24-52
Contact Information: Payload withheldAuthor contact information is present but does not constitute backdoor behavior.README.md:76-78

Review boundaries

What the analysis did not establish

One file (LICENSE) is omitted from the text content; its absence does not affect classification as it is not a code or behavior file.
The evidence does not include any exploit payloads or proof of exploitation; classification is based solely on the provided scanner templates and documentation.
One file (LICENSE) was omitted from the text evidence; its content was not reviewed.
Binary content was not present in the evidence packet.
The review is limited to the supplied text evidence and does not assess the safety of external links or the Nuclei framework itself.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubcyberleelawat/FreePBX-Multiple-CVEs-2025Repository PoCby cyberleelawat1Scanner5 files

44.2 KiB · linked to 3 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

The artifact contains three Nuclei YAML templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. The templates do not send exploit payloads; they only perform version fingerprinting and matching.

Backdoor review

No backdoor observed in reviewed code

The repository contains three Nuclei YAML templates and a README for detecting known FreePBX vulnerabilities. The templates perform only non-invasive version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.

ClassificationScanner

Model confidence98%

AuthenticationNot required

LanguagesYAMLMarkdown

Target softwareFreePBX

Attack typesversion detectionvulnerability scanning

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

All three YAML templates only extract the FreePBX version and compare it against known vulnerable ranges; they do not send any SQL injection, file upload, or authentication bypass payloads. The README explicitly states the detection is non-invasive and does not attempt exploitation. This is consistent with a vulnerability scanner, not an exploit.

CVE-2025-61675.yaml:24-52CVE-2025-61678.yaml:24-52CVE-2025-66039.yaml:24-52README.md:42

Requirements

Target must expose the FreePBX administration panel at /admin/config.php.CVE-2025-61675.yaml:25-26
Nuclei engine must be installed to execute the templates.README.md:149-150

Observed behavior

Sends a GET request to /admin/config.php and extracts the FreePBX version using a regex.CVE-2025-61675.yaml:24-34
Matches the response body for FreePBX-specific strings and a 200 status code.CVE-2025-61675.yaml:36-48
Compares the extracted version against vulnerable version ranges using a DSL expression.CVE-2025-61675.yaml:50-52
README states the detection is non-invasive and does not attempt to exploit the vulnerabilities.README.md:42

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template: Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No exploit payload is sent.CVE-2025-61675.yaml:24-52
Nuclei Template: Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No file upload or shell payload is present.CVE-2025-61678.yaml:24-52
Nuclei Template: Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No forged Authorization header or authentication bypass attempt is made.CVE-2025-66039.yaml:24-52
Repository Metadata: Payload withheldREADME identifies the author and organization. This is standard metadata and does not indicate backdoor behavior.README.md:200-202

Review boundaries

What the analysis did not establish

One text file (likely an image) was omitted from the packet; its content is not available for analysis.
The templates are not executed; classification is based solely on static analysis of the provided YAML and README content.
One file (unclassified, 35149 bytes) was not analyzed because it was flagged as binary/metadata-only; its content is unknown.
The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

github.com

https://github.com/FreePBX/framework/commit/04224253156543cd9932b90458660b2f19fc0e35

github.comConfirmation

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698

freepbx.org

https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80