FreePBX is vulnerable to multiple authenticated SQL injection attacks that could lead to full database compromise if exploited by an authorized user.

This vulnerability is a SQL injection (CWE-89) flaw residing within the logfiles module of FreePBX. It requires the attacker to have high privileges to successfully inject malicious SQL commands into the backend database.

The vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for total compromise of the database. Successful exploitation allows an authenticated user to gain unauthorized access to sensitive system data, potentially leading to information disclosure, data manipulation, or total loss of integrity within the PBX system.

Immediate Action: Update FreePBX to version 16.0.10, 17.0.5, or later to incorporate the vendor-provided security patches.

Proactive Monitoring: Review system and database logs for unusual query patterns, particularly those involving the logfiles module, which may indicate attempted exploitation.

Compensating Controls: Restrict administrative access to the FreePBX management interface to known, trusted IP addresses and enforce strong multi-factor authentication for all administrative accounts.

Public Exploit Available: Unknown

The risk posed by this SQL injection vulnerability is significant due to the potential for complete database control. Security teams must prioritize updating to the patched versions immediately to eliminate the threat. Limiting administrative access remains a critical layer of defense while the update is being staged.