FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE

"CVE-2025-61675 (CVSS score: 8.6) - Numerous authenticated SQL injection vulnerabilities impacting four unique endpoints (basestation, model, firmware, and custom extension) and 11 affected parameters that enable read and write access to the underlying SQL database CVE-2025-61678 (CVSS score: 8.6) - An authenticated arbitrary file upload vulnerability that allows an attacker to exploit the firmware upload endpoint to upload a PHP web shell after obtaining a valid PHPSESSID and run arbitrary commands to leak the contents of sensitive files (e.g., "/etc/passwd")"

"CVE-2025-66039 (CVSS score: 9.3) - An authentication bypass vulnerability that occurs when the "Authorization Type" (aka AUTHTYPE) is set to "webserver," allowing an attacker to log in to the Administrator Control Panel via a forged Authorization header It's worth mentioning here that the authentication bypass is not vulnerable in the default configuration of FreePBX, given that the "Authorization Type" option is only displayed when the three following values in the Advanced Settings Details are set to "Yes": Display Friendly Name Display Readonly Settings, and Override Readonly Settings"

"However, once the prerequisite is met, an attacker could send crafted HTTP requests to sidestep authentication and insert a malicious user into the "ampusers" database table, effectively accomplishing something similar to CVE-2025-57819, another flaw in FreePBX that was disclosed as having been actively exploited in the wild in September 2025."

Multiple critical vulnerabilities in the FreePBX PBX platform enable authenticated SQL injection, authenticated arbitrary file upload, and an authentication bypass under specific configurations. CVE-2025-61675 comprises numerous authenticated SQL injection flaws across basestation, model, firmware, and custom extension endpoints with 11 vulnerable parameters enabling read and write access to the SQL database. CVE-2025-61678 allows authenticated attackers with a valid PHPSESSID to upload a PHP web shell via the firmware upload endpoint and execute commands to exfiltrate files such as /etc/passwd. CVE-2025-66039 permits login to the Administrator Control Panel via a forged Authorization header when Authorization Type is set to webserver. The bypass requires three Advanced Settings flags to be set to Yes. Horizon3.ai reported the issues on September 15, 2025.

Read at The Hacker News