FreePBX versions prior to 16.0.50 and 17.0.11 allow an authenticated user who has access to the CDR section of the Administration Control Panel to perform SQL injection via the order and sort POST parameters on the CDR Reports module. This vulnerability is a classic SQL injection (CWE‑89) that can be exploited to read, modify, or delete records in the underlying database, potentially exposing sensitive call details or compromising the integrity of the PBX data.

All FreePBX installations running 16.x versions earlier than 16.0.50 or 17.x versions earlier than 17.0.11 are affected. The flaw exists in the CDR Reports module that is accessible to users with CDR section privileges; full administrator rights are not required.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, making the current likelihood of exploitation unclear, but the vulnerability is listed as not part of the CISA KEV catalog. Attackers need only authenticate to a FreePBX account with CDR access; no additional privileges are required. Once authenticated, an attacker can craft malicious ORDER BY strings to manipulate SQL queries and potentially exfiltrate confidential data.