FreePBX is an open-source web-based graphical user interface. The `endpoint` module contains an authentication bypass and SQL injection flaw caused by insufficiently sanitized user-supplied data. This allows unauthenticated attackers to bypass login controls, manipulate the database, and achieve remote code execution with SYSTEM-level privileges. Real-world incidents of active exploitation have been detected.