A high severity SQL injection vulnerability in the FreePBX cdr module allows authenticated attackers to compromise backend data integrity and system security.

The cdr module contains an improper neutralization of special elements used in an SQL command, which constitutes a classic SQL injection vulnerability. This flaw requires the attacker to possess high privileges to interact with the vulnerable component.

Successful exploitation of this vulnerability permits an attacker to execute unauthorized SQL queries against the underlying database. Given the CVSS score of 8.8, this poses a significant risk of data exfiltration, unauthorized modification of call records, or potential escalation of impact to the host system.

Immediate Action: Update the FreePBX cdr module to version 16.0.49 or 17.0.7 immediately to incorporate the vendor patch.

Proactive Monitoring: Review database query logs for unusual syntax or unexpected patterns originating from the cdr module, and monitor system logs for signs of unauthorized administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide a temporary layer of protection while update schedules are finalized.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to data integrity within the FreePBX environment. System administrators should prioritize the application of the specified security updates to versions 16.0.49 or 17.0.7 to neutralize the risk of unauthorized database manipulation.