Freepbx Framework
Monthly
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.