CVE-2026-44238: FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports

Synopsis

This is an authenticated SQL injection in FreePBX's CDR Reports module, triggered through the `order` and `sort` POST parameters used in ORDER BY clauses. The flaw is reachable over the network and requires a logged-in Administration Control Panel account with CDR section access (full admin is not needed). Successful exploitation lets the attacker read and modify arbitrary data in the FreePBX database, including call detail records and configuration tables. A patched-image rebuild at 16.0.50 or 17.0.11 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FreePBX Administration Control Panel over the network (AV:N).

• AuthenticationRequired

  A valid FreePBX admin-panel account with CDR section access is required (PR:H), though full administrator privileges are not needed.

• Victim interactionNot required

  No user interaction is needed; the attacker sends the crafted POST request directly (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L): the injection through `order` and `sort` parameters is reliable and has no environmental preconditions.

Blast Radius

• Reads arbitrary rows from the FreePBX database, including call detail records, extension configuration, and stored credentials or secrets held in PBX tables.
• Modifies persisted database rows, allowing tampering with call records, user accounts, dialplan settings, or other PBX configuration.
• Does not directly impact availability of the PBX service (VA:N), and scope does not extend beyond the FreePBX database itself.