FreePBX SQL Injection Vulnerability Leads to Database Tampering

A critical SQL injection vulnerability in FreePBX, designated as CVE-2025-57819, has been actively exploited to modify the database and achieve arbitrary code execution on vulnerable systems. The flaw resides in the endpoint module’s AJAX handler at the /admin/ajax.php endpoint, where the brand parameter is not properly sanitised. Attackers inject SQL commands via crafted requests to the ajax.php file, enabling them to insert arbitrary entries into the cron_jobs database table used for scheduled tasks.

This persistence mechanism allows malicious commands to run automatically, effectively enabling persistent code execution on affected systems. Security researchers have observed real‑world exploitation attempts that deploy PHP web shells and aim for complete system compromise, highlighting risks such as backdoor access, altered call routing, and access to call detail records.

Sangoma released security patches on 28 August 2025 covering all supported versions, and organisations are urged to update FreePBX installations via the Administrator Control Panel or standard module repositories for versions 15, 16, and 17.