CVE-2026-73663 in FreePBX
Summary
by MITRE • 08/13/2026
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability resides within the FreePBX missedcall module, which serves as a critical component for tracking unanswered calls in IP PBX systems. This particular flaw exists in versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3, where the system fails to properly sanitize user input from SIP protocol headers. The specific technical weakness manifests in the agi-bin/missedcallnotify.php script which directly incorporates caller ID information from the SIP From header into database queries without any form of input validation or parameterization. This represents a classic sql injection vulnerability that falls under CWE-89, which specifically addresses SQL injection flaws where untrusted data is incorporated into SQL commands without proper sanitization.
The operational impact of this vulnerability extends far beyond simple data corruption, as it provides attackers with a pathway to escalate privileges and gain unauthorized administrative access to the FreePBX system. When an unauthenticated malicious actor sends a crafted SIP message containing specially formatted caller ID information, the system processes this input directly into a database insert statement. The attacker can manipulate the Caller ID name field to inject SQL commands that modify administrator account credentials, effectively allowing remote code execution and complete system compromise. This vulnerability aligns with ATT&CK technique T1078 which covers valid accounts usage for persistence and privilege escalation.
The exploitation process requires minimal network access since the attack vector operates through standard SIP protocol communication channels that are typically exposed to external networks for telephony services. The attack is particularly dangerous because it can be executed without authentication, making it accessible to anyone with knowledge of the target system's extension monitoring configuration. Database corruption occurs when the malicious SQL injection payload executes against the missedcalllog table, potentially creating backdoor accounts or modifying existing administrator credentials. This vulnerability demonstrates a critical lack of input sanitization and proper database query construction practices that should be implemented according to industry standards for secure coding. The fix implemented in versions 16.0.11 and 17.0.4 addresses this by introducing proper parameter binding and input validation mechanisms, ensuring that all external data is properly escaped before being incorporated into database operations. Organizations running affected FreePBX versions should immediately implement these updates to prevent potential compromise of their telephony infrastructure and protect against unauthorized access to sensitive communication systems.