CVE-2025-11138

Executive Summary

CVE-2025-11138 is a critical OS Command Injection vulnerability discovered in the createPathOne function within the app/common/common.php file of mirweiye wenkucms, affecting versions up to and including 3.4. This flaw allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the underlying server. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. The vendor has not yet released a patch, leaving all instances of wenkucms 3.4 and earlier vulnerable to remote compromise.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the wenkucms application. Organizations using wenkucms should treat this as a critical supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: High. Despite the medium CVSS score, the public availability of a working exploit and the lack of a patch elevate the real-world risk. An attacker can achieve full command execution, potentially leading to complete server compromise.

Deep Dive & Mechanics

The vulnerability resides in the createPathOne function within app/common/common.php. This function is designed to create directory paths, but it improperly sanitizes user-supplied input before passing it to a system command (likely mkdir or similar). By injecting shell metacharacters (e.g., ;, |, &&, `), an attacker can break out of the intended command and execute arbitrary OS commands.

The core issue is the use of a function like exec(), system(), or shell_exec() with unsanitized input. For example, if the function constructs a command like mkdir -p /path/to/{user_input}, an attacker can provide input such as ; id > /tmp/out to execute the id command and write its output to a file.

The attack is launched remotely via HTTP requests to the vulnerable endpoint. The exact parameter is not specified in the public disclosure, but it is likely a GET or POST parameter that is passed to createPathOne.

Vulnerable vs. Patched Code

Vulnerable Code (wenkucms <= 3.4):

// app/common/common.php
function createPathOne($path) {
    // No input sanitization
    $command = "mkdir -p " . $path;
    exec($command, $output, $return_var);
    return $return_var;
}

Patched Code (Hypothetical):

// app/common/common.php
function createPathOne($path) {
    // Sanitize input: escape shell arguments
    $safe_path = escapeshellcmd($path);
    $command = "mkdir -p " . $safe_path;
    exec($command, $output, $return_var);
    return $return_var;
}

The patched version uses escapeshellcmd() to prevent command injection. However, since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target.com/"
payload = "; id; #"
params = {"path": payload}

response = requests.get(target + "index.php?m=admin&c=common&a=createPathOne", params=params)
print(response.text)

Explanation: This exploit sends a GET request to the vulnerable endpoint with a malicious path parameter. The injected command id will be executed on the server, and the output may be reflected in the response or written to a file.

Lab Setup:

1. Deploy a vulnerable instance of wenkucms 3.4 in a Docker container.
2. Use the above Python script to test command execution.
3. Verify by checking for the output of the id command.

Blue Team

Detection Steps:

1. Monitor web server logs for unusual parameters containing shell metacharacters (;, |, &, `).
2. Look for requests to the createPathOne endpoint with suspicious path values.
3. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?m=admin&c=common&a=createPathOne with path parameter containing shell metacharacters.
  • Outbound connections from the web server to attacker-controlled IPs (if reverse shell is executed).
• File System IOCs:
  • Unexpected files in /tmp/ or web root (e.g., /tmp/out).
  • New user accounts or modified system binaries.
• Process IOCs:
  • Unusual processes spawned by the web server user (e.g., id, whoami, nc).

Detection Engineering

YARA Rule

rule CVE_2025_11138_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11138 in wenkucms"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11138"
    strings:
        $s1 = "createPathOne" nocase
        $s2 = "app/common/common.php" nocase
        $s3 = /[;&|`$]/  // Shell metacharacters
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-11138 Wenkucms Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-11138
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'createPathOne'
        cs-uri-query|contains|all:
            - 'path='
            - ';'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in path names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11138 Wenkucms Command Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"createPathOne"; http_uri; content:"path="; http_uri; pcre:"/path=[^&]*[;&|`]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, block access to index.php?m=admin&c=common&a=createPathOne via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply input validation: Implement strict input validation for the path parameter, allowing only alphanumeric characters, slashes, and underscores.
3. Upgrade: Monitor the vendor for a patch. If none is released, consider migrating away from wenkucms.

Long-term Fix:

• Replace exec() with safer alternatives like PHP's mkdir() function, which does not invoke a shell.
• Use escapeshellcmd() or escapeshellarg() if shell commands are unavoidable.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers