FreePBX up to 15.0.65/16.0.88/17.0.2 sql injection

Summaryinfo

A vulnerability, which was classified as critical, was found in FreePBX up to 15.0.65/16.0.88/17.0.2. This impacts an unknown function. The manipulation results in sql injection. This vulnerability is reported as CVE-2025-57819. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in FreePBX up to 15.0.65/16.0.88/17.0.2. It has been classified as critical. Affected is some unknown functionality. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-57819 since 08/20/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

It is declared as attacked. This issue was added on 08/29/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 09/19/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 15.0.66, 16.0.89 or 17.0.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (1024) and EUVD (EUVD-2025-26123). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• FreePBX

Version

• 15.0.0
• 15.0.1
• 15.0.2
• 15.0.3
• 15.0.4
• 15.0.5
• 15.0.6
• 15.0.7
• 15.0.8
• 15.0.9
• 15.0.10
• 15.0.11
• 15.0.12
• 15.0.13
• 15.0.14
• 15.0.15
• 15.0.16
• 15.0.17
• 15.0.18
• 15.0.19
• 15.0.20
• 15.0.21
• 15.0.22
• 15.0.23
• 15.0.24
• 15.0.25
• 15.0.26
• 15.0.27
• 15.0.28
• 15.0.29
• 15.0.30
• 15.0.31
• 15.0.32
• 15.0.33
• 15.0.34
• 15.0.35
• 15.0.36
• 15.0.37
• 15.0.38
• 15.0.39
• 15.0.40
• 15.0.41
• 15.0.42
• 15.0.43
• 15.0.44
• 15.0.45
• 15.0.46
• 15.0.47
• 15.0.48
• 15.0.49
• 15.0.50
• 15.0.51
• 15.0.52
• 15.0.53
• 15.0.54
• 15.0.55
• 15.0.56
• 15.0.57
• 15.0.58
• 15.0.59
• 15.0.60
• 15.0.61
• 15.0.62
• 15.0.63
• 15.0.64
• 15.0.65
• 16.0.0
• 16.0.1
• 16.0.2
• 16.0.3
• 16.0.4
• 16.0.5
• 16.0.6
• 16.0.7
• 16.0.8
• 16.0.9
• 16.0.10
• 16.0.11
• 16.0.12
• 16.0.13
• 16.0.14
• 16.0.15
• 16.0.16
• 16.0.17
• 16.0.18
• 16.0.19
• 16.0.20
• 16.0.21
• 16.0.22
• 16.0.23
• 16.0.24
• 16.0.25
• 16.0.26
• 16.0.27
• 16.0.28
• 16.0.29
• 16.0.30
• 16.0.31
• 16.0.32
• 16.0.33
• 16.0.34
• 16.0.35
• 16.0.36
• 16.0.37
• 16.0.38
• 16.0.39
• 16.0.40
• 16.0.41
• 16.0.42
• 16.0.43
• 16.0.44
• 16.0.45
• 16.0.46
• 16.0.47
• 16.0.48
• 16.0.49
• 16.0.50
• 16.0.51
• 16.0.52
• 16.0.53
• 16.0.54
• 16.0.55
• 16.0.56
• 16.0.57
• 16.0.58
• 16.0.59
• 16.0.60
• 16.0.61
• 16.0.62
• 16.0.63
• 16.0.64
• 16.0.65
• 16.0.66
• 16.0.67
• 16.0.68
• 16.0.69
• 16.0.70
• 16.0.71
• 16.0.72
• 16.0.73
• 16.0.74
• 16.0.75
• 16.0.76
• 16.0.77
• 16.0.78
• 16.0.79
• 16.0.80
• 16.0.81
• 16.0.82
• 16.0.83
• 16.0.84
• 16.0.85
• 16.0.86
• 16.0.87
• 16.0.88
• 17.0.0
• 17.0.1
• 17.0.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion