CVE-2025-10233
📋 TL;DR
This path traversal vulnerability in kalcaddle kodbox 1.61 allows remote attackers to read or write arbitrary files by manipulating the 'path' parameter in fileGet/fileSave functions. It affects all systems running the vulnerable version of kodbox file management software. The vulnerability is remotely exploitable and public exploit details exist.
💻 Affected Systems
- kalcaddle kodbox
📦 What is this software?
Kodbox by Kodcloud
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files (like configuration files with credentials) or writing malicious files to achieve remote code execution.
Likely Case
Unauthorized file access leading to information disclosure, configuration file theft, or limited file modification.
If Mitigated
No impact if proper input validation and path sanitization are implemented.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the 'path' parameter to prevent directory traversal sequences like '../'
Modify app/controller/explorer/editor.class.php to sanitize path inputs
Web Application Firewall Rules
allDeploy WAF rules to block path traversal patterns in requests to fileGet/fileSave endpoints
🧯 If You Can't Patch
- Restrict network access to kodbox instances using firewall rules
- Implement strict file system permissions to limit what kodbox can access
🔍 How to Verify
Check if Vulnerable:
Check if kodbox version is 1.61 by examining version files or configurationCheck Version:
Check kodbox version in configuration files or admin panelVerify Fix Applied:
Test fileGet/fileSave functionality with path traversal payloads to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Multiple failed attempts with '../' patterns in file requests
- Unusual file access patterns outside expected directories
Network Indicators:
- HTTP requests containing path traversal sequences to editor.class.php endpoints
SIEM Query:
source="web_logs" AND (uri="*editor.class.php*" AND (query="*../*" OR query="*..\\*"))