FreePBX, a widely used open-source PBX platform, has been found vulnerable to a critical SQL injection flaw. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, system compromise, and disruption of telephony services. The flaw stems from insufficient input validation in FreePBX's web interface, which cybercriminals can exploit to manipulate backend databases. Organizations using FreePBX are urged to apply security patches immediately and implement robust monitoring to detect suspicious activities. This incident highlights the importance of securing VoIP infrastructure against injection attacks, which remain a prevalent threat vector in telecommunications environments. The FreePBX community and security teams are actively working on mitigation strategies and updates to prevent exploitation. Users should also review their system logs and access controls to minimize exposure. Staying informed about such vulnerabilities is crucial for maintaining operational integrity and protecting sensitive communication data from cyber threats.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 09 Oct 2025 00:15:13 +0000