FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

FreePBX versions 15, 16, and 17 contain a flaw that allows attackers to bypass login requirements and gain unauthorized administrator access without credentials, which can then be exploited to manipulate the database or execute arbitrary code on the server.

An authentication bypass vulnerability in FreePBX 15–17 enables unauthenticated attackers to access the Administrator interface through insufficiently sanitized user input. This leads to chained SQL injection (CWE-89) and remote code execution capabilities, affecting core system integrity without requiring prior credentials or user interaction.