Description
FreePBX 是一个流行的开源电话系统管理工具。该漏洞存在于 FreePBX 的 endpoint 模块中，攻击者可以通过构造恶意的 SQL 查询注入到系统中，从而获取敏感信息或执行任意代码。这可能导致系统被完全控制，敏感数据泄露或服务中断。
FreePBX /admin/ajax.php brand SQL 注入漏洞（CVE-2025-57819）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-57819
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/
https://isc.sans.edu/diary/32350
https://www.ionix.io/blog/cve-2025-57819-freepbx-authentication-bypass/
https://horizon3.ai/attack-research/vulnerabilities/cve-2025-57819/
https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
https://thehackernews.com/2025/08/freepbx-servers-targeted-by-zero-day.html