CVE-2025-57819 PoC — FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

Source

Associated Vulnerability

Description

This is repository contains a script to check for current IOCs listed in the freepbx forum topic of the CVE-2025-57819

Readme

# CVE-2025-57819-ioc-check
## Description
CVE-2024-6387-ioc-check is a lightweight, efficient tool designed to identify IoCs on freepbx servers with any of `endpoint < 15.0.66, endpoint < 16.0.89, endpoint < 17.0.3` modules installed.

This script facilitates rapid checking of multiple IoCs to detect potential compromises and ensure your infrastructure is secure.

## Usage
```bash
 curl "https://raw.githubusercontent.com/Sucuri-Labs/CVE-2025-57819-ioc-check/refs/heads/main/check.sh" -o /tmp/check.sh
 cat /tmp/check.sh
 bash /tmp/check.sh
```
## Mitigation
> Users should upgrade to the latest supported versions of FreePBX (currently 15, 16, and 17) and confirm that the installed "endpoint" module meets the minimum patched versions. Systems not configured for automatic updates, or those wishing to manually update, can do so via the Administrator Control Panel menu Admin -> Module Admin or via generic command line method of updating all modules:
>
> `$ fwconsole ma upgradeall`
>
> Then checking for the "endpoint" module version number:
>
> `$ fwconsole ma list | grep endpoint`
>
>  Further steps, including suggestions for IOC inspection and Firewall configuration, as well as corner-case considerations, are available in the FreePBX Community Forums under the "Security Advisory: Please Lock Down Your Administrator Access" topic at https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203

Source: [Authentication Bypass Leading to SQL Injection and RCE](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)

## References
[Security Advisory: Please Lock Down Your Administrator Access](https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203)

[Authentication Bypass Leading to SQL Injection and RCE](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)

File Snapshot

 [4.0K]  /data/pocs/a21cc95a7714ef04be0565746a705f9cbd7794fa
├── [1.4K]  check.sh
├── [1.0K]  LICENSE
└── [1.9K]  README.md

0 directories, 3 files

Remarks