CVE-2025-15153

Executive Summary

CVE-2025-15153 identifies a weakness in PbootCMS up to version 3.2.12, specifically in the SQLite database file /data/pbootcms.db. The vulnerability allows an attacker to access files or directories remotely due to improper access controls on the database file. The attack is highly complex and difficult to exploit, but a public exploit is available. The CVSS score is 3.7 (Low), indicating limited impact, but the exposure of the database file could lead to information disclosure. No official patch has been confirmed, and the vendor's patch status is unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: High (AC:H) – The attack requires significant effort or specific conditions.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The high complexity and low impact reduce the immediate risk, but the public exploit increases the need for monitoring.

Deep Dive & Mechanics

The vulnerability lies in the SQLite database file /data/pbootcms.db within PbootCMS. This file is stored in the web root and is accessible via direct URL requests if the web server is not configured to block access to .db files. An attacker can download the database file, which may contain sensitive information such as user credentials, configuration data, or other application secrets.

The attack is considered highly complex because it requires the attacker to know the exact path and filename, and the web server must not have proper access controls. However, since the file is in a predictable location, it can be exploited with a simple HTTP GET request.

Vulnerable vs. Patched Code

Vulnerable Code (PbootCMS <= 3.2.12): The database file /data/pbootcms.db is stored in the web root without proper access restrictions. The web server serves the file directly if requested.

Patched Code (UNKNOWN): No official patch has been released. A potential fix would involve:

• Moving the database file outside the web root.
• Configuring the web server to deny access to .db files.
• Implementing authentication or access controls for the database file.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install PbootCMS version 3.2.12 on a local server (e.g., using XAMPP or Docker).
2. Ensure the web server is configured to serve files from the web root.
3. Access the application and create some content to populate the database.

Exploitation Steps:

1. Identify the target URL (e.g., http://target.com/).
2. Send a GET request to the database file:

   GET /data/pbootcms.db HTTP/1.1
   Host: target.com
   

3. If successful, the server returns the SQLite database file.
4. Download the file and open it with a SQLite browser (e.g., DB Browser for SQLite) to extract sensitive data.

Example using curl:

curl -O http://target.com/data/pbootcms.db

Blue Team

Detection:

• Monitor web server logs for requests to /data/pbootcms.db or similar paths.
• Look for unusual HTTP 200 responses for .db files.
• Use file integrity monitoring to detect unauthorized access to database files.

Prevention:

• Configure the web server to deny access to .db files:
  • Apache: Add to .htaccess or virtual host config:

    <FilesMatch "\.db$">
      Require all denied
    </FilesMatch>
    

  • Nginx: Add to server block:

    location ~* \.db$ {
      deny all;
    }
    

• Move the database file outside the web root (e.g., to /var/db/).
• Implement authentication for sensitive files.

Indicators of Compromise (IOCs)

• File Path: /data/pbootcms.db
• HTTP Request: GET request to /data/pbootcms.db
• Network Traffic: Outbound connections from the server to an attacker's IP after database download.
• Log Entries: Web server logs showing 200 OK for .db files.

Detection Engineering

YARA Rule

rule CVE_2025_15153_PbootCMS_DB_Access {
  meta:
    description = "Detects attempts to access PbootCMS SQLite database file"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-15153"
  strings:
    $db_path = "/data/pbootcms.db"
    $http_get = "GET"
  condition:
    $http_get at 0 and $db_path
}

Sigma Rule

title: CVE-2025-15153 PbootCMS Database File Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP GET requests to the PbootCMS SQLite database file
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-15153
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem: '/data/pbootcms.db'
  condition: selection
falsepositives:
  - Legitimate administrative access (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15153 PbootCMS Database File Access"; flow:to_server; content:"GET"; http_method; content:"/data/pbootcms.db"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Mitigation:

   • Configure the web server to deny access to .db files (see Blue Team section).
   • Move the database file outside the web root.
   • Restrict access to the /data/ directory via .htaccess or server config.

2. Long-term Remediation:

   • Apply any official patch from PbootCMS when available.
   • Upgrade to a patched version if released.
   • Implement file integrity monitoring for critical files.

3. Monitoring:

   • Enable logging for all web requests and monitor for suspicious patterns.
   • Use the provided detection rules to alert on exploitation attempts.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.