A missing CSRF token check in the FreePBX Framework 17.0 /admin/ajax.php dispatcher allows an unauthenticated remote attacker to perform privileged administrative operations on a system that has an authenticated administrator logged in. The vulnerability is a classic cross‑site request forgery (CWE‑352) that enables the attacker to impersonate the administrator and trigger actions without the administrator’s explicit consent.

Products affected are FreePBX Framework version 17.0. The vulnerability exists in the amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php file that handles Ajax requests in the admin panel.

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. No EPSS score is available and it is not listed in the CISA KEV catalog. The attack vector is a CSRF scenario where the attacker lures a legitimate administrator to a malicious web page; the request to /admin/ajax.php can be sent without a Referer header or from a same‑site context, bypassing the thin referer check and allowing the attacker to invoke any admin function tied to the Ajax dispatcher.