FreePBX Endpoint Manager unauth SQLi to RCE (CVE-2025-57819); public exploit

Exploit-DB entry 52681 (dated 3 September 2026) documents a public remote-code-execution exploit for CVE-2025-57819 in FreePBX Endpoint Manager. The flaw is an unauthenticated SQL injection in the brand parameter of /admin/ajax.php that can insert a malicious cron_jobs row and yield a reverse shell as the web user. Affected branches per the exploit write-up: FreePBX 15.x before 15.0.66, 16.x before 16.0.89, and 17.x before 17.0.3 (title tested against 17.0.2). The write-up cites CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-89 and CWE-288, NVD, and GitHub advisory GHSA-m42g-xg4c-5f3h. Upgrade Endpoint Manager / FreePBX to the fixed releases; restrict admin/ajax exposure; hunt for unexpected cron_jobs entries.

Product

FreePBX Endpoint Manager

Versions

15.x < 15.0.66; 16.x < 16.0.89; 17.x < 17.0.3 (per EDB 52681)

CVSS

9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H per EDB write-up)

Exploited in Australia?

unknown

Patch to

FreePBX / Endpoint Manager 15.0.66+, 16.0.89+, or 17.0.3+; audit cron_jobs; limit unauth reachability of /admin/ajax.php

Primary: NVD CVE-2025-57819 · Vendor: FreePBX GHSA-m42g-xg4c-5f3h · CVE: CVE-2025-57819 · Exploit-DB 52681 (3 Sep 2026)

vulnerabilities network