https://bokkapig.pages.dev/tags/sql-injection/Recent content in SQL Injection on bokkapigHugoen-gbSat, 06 Jun 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/connected/Sat, 06 Jun 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/connected/An unauthenticated stacked SQL injection in the FreePBX 16 endpoint module (CVE-2025-57819) inserts a full-access administrator directly into the ampusers table, and the Endpoint Manager firmware uploader (CVE-2025-61678) is then abused with a path traversal to drop a PHP webshell, yielding code execution as asterisk and the user flag. FreePBX config files leak the MariaDB credentials in plaintext, granting write access to the asterisk database. The root-run synologyabb sysadmin hook execs a DB-controlled CLI path, so repointing the SYNOLOGYABFBABBCLI setting at an attacker script and firing the incron trigger runs it as root.