Session hijacking via information exposure in Hitachi Ops Center API Configuration Manager / Configuration Manager / Device Manager

This is a small standalone Python exploit repository containing one primary executable script (exploit.py), a README, and a requirements file. The exploit targets FreePBX versions earlier than 16.0.26.0 and claims CVE-2025-57819, abusing a SQL injection condition in the web-accessible AJAX endpoint /admin/ajax.php. The script is not part of a larger exploitation framework. Repository structure and purpose: README.md explains the vulnerability, usage, and expected outcomes; exploit.py implements the attack flow; requirements.txt lists Python dependencies. The Python script uses requests with TLS verification disabled, accepts a target host plus attacker callback host/port, and constructs SQL injection strings appended to GET requests against host/admin/ajax.php. Main exploit capability: the script attempts remote code execution by injecting INSERT statements into the cron_jobs table. The first injected cron job writes a base64-decoded PHP webshell into /var/www/html/pbxshell.php. The script then polls the resulting URL for up to 120 seconds to confirm creation. The second injected cron job writes a PHP reverse shell wrapper into /var/www/html/auto_rev.php; that payload executes a bash reverse shell to the supplied LHOST:LPORT. The script also starts a local netcat listener to catch the callback. Notable observables and targets include the vulnerable endpoint /admin/ajax.php, dropped files /var/www/html/pbxshell.php and /var/www/html/auto_rev.php, the pbxshell.php web path, the cron_jobs database table, and the reverse-shell callback over TCP to the attacker-supplied host and port. Overall, this is an operational RCE exploit with hardcoded payload behavior rather than a detection-only script.