Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-66039. PoCs published by cyberleelawat, BimBoxH4.
AI-analyzed exploit summary This repository provides Nuclei templates for detecting three FreePBX vulnerabilities (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675) via version checks and non-invasive detection methods. It includes dorks for identifying vulnerable instances but does not contain exploit code.
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
Exploits (2)
This repository provides Nuclei templates for detecting three FreePBX vulnerabilities (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675) via version checks and non-invasive detection methods. It includes dorks for identifying vulnerable instances but does not contain exploit code.
This repository contains a Python-based scanner for detecting and exploiting multiple FreePBX vulnerabilities (CVE-2025-66039, CVE-2025-61675, CVE-2025-61678), including authentication bypass, SQL injection, and file upload RCE. The tool is designed for educational and authorized testing purposes.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H