Executive brief
FreePBX is an open-source phone system management platform. A security vulnerability in its Call Detail Record (CDR) reporting module allows an authorized user to perform unauthorized database queries. While an attacker needs an account with access to the reporting section, they could use this flaw to view or modify sensitive information stored in the system's database.
Technical details
An authenticated SQL injection vulnerability exists in the CDR Reports module of FreePBX. The vulnerability is located in the 'order' and 'sort' POST parameters, which are interpolated directly into the ORDER BY clause of SQL queries. While the application uses escapeSimple(), this function only escapes single quotes and fails to prevent structural SQL injection in unquoted ORDER BY contexts. An attacker with FreePBX Administration Control Panel access and CDR section permissions can exploit this to execute arbitrary SQL commands. The issue is resolved in CDR module versions 16.0.50 and 17.0.11.
Affected products
- FreePBX cdr (FreePBX 16) < 16.0.50
- FreePBX cdr (FreePBX 17) < 17.0.11
Timeline
- 2026-05-19: advisory: Original GitHub advisory published
- 2026-05-29: disclosed: NVD publication date