Loading vulnerability…
Authenticated SQL Injection in FreePBX Endpoint Manager
CVE-2025-61675 is an authenticated SQL injection vulnerability affecting the FreePBX Endpoint Manager module. In FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6, multiple input parameters in the basestation, model, firmware, and custom extension configuration areas are insufficiently sanitized before being incorporated into SQL queries. The issue affects multiple endpoints and numerous parameters, allowing an authenticated attacker with a known username to inject arbitrary SQL statements. Successful exploitation enables direct interaction with the underlying database, including unauthorized querying and modification of application data. Public reporting also indicates that one of the vulnerable custom extension injection paths can be leveraged to create unauthorized administrative users or to insert scheduled tasks into database-backed job mechanisms when chained with other weaknesses.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to execute arbitrary SQL queries against the FreePBX database. This can result in disclosure of sensitive information, unauthorized modification or deletion of records, creation of rogue administrative accounts, and manipulation of application state. In attack chains, the database write capability may be used to schedule execution of attacker-controlled actions through application job mechanisms, contributing to full system compromise and remote code execution when combined with additional vulnerabilities or insecure configurations.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to Endpoint Manager administrative functionality to trusted users only, minimize the number of accounts with access to affected configuration areas, and closely monitor database and application administrative changes for anomalous activity. Because exploitation requires authenticated access to vulnerable module functionality, reducing exposure of the management interface and enforcing strong account controls can lower risk until patched versions are deployed. Where relevant, also eliminate auxiliary weaknesses that could provide unauthenticated access to authenticated functionality.
Patch, then assume compromise.
Upgrade the FreePBX Endpoint Manager module to a fixed release. The vulnerability is patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. Organizations should also review database contents for unauthorized changes, including unexpected privileged accounts or maliciously inserted scheduled jobs, and rotate credentials if compromise is suspected.
1 exploit validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.