CVE-2025-13185
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to the Bdtask/CodeCanyon News365 system via the profile_image/banner_image parameter in the /admin/dashboard/profile endpoint. This affects all users running News365 versions up to 7.0.3, potentially enabling file upload attacks.
💻 Affected Systems
- Bdtask/CodeCanyon News365
📦 What is this software?
News365 by Bdtask
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload malicious files (webshells, backdoors) leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Attackers upload webshells to gain persistent access, deface websites, or use the server for malicious activities like phishing or malware distribution.
If Mitigated
With proper file upload validation, only authorized users can upload verified file types, preventing malicious uploads.
🎯 Exploit Status
Exploit details are publicly available; attack requires access to the admin dashboard but no authentication bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available; vendor did not respond to disclosure. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Restrict File Uploads via Web Server
allConfigure web server (e.g., Apache, Nginx) to block uploads to the vulnerable endpoint or restrict file types.
# Apache: Add to .htaccess
<FilesMatch "profile_image|banner_image">
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~* /admin/dashboard/profile {
deny all;
}
Implement Application-Level Validation
allAdd server-side validation to restrict file types, check file signatures, and limit upload sizes.
# Example PHP validation snippet
$allowed_types = ['image/jpeg', 'image/png'];
$max_size = 2097152; // 2MB
if (!in_array($_FILES['profile_image']['type'], $allowed_types) || $_FILES['profile_image']['size'] > $max_size) {
die('Invalid file');
}
🧯 If You Can't Patch
- Disable the vulnerable endpoint entirely via web server configuration or application code.
- Implement network-level controls (WAF) to block malicious upload patterns and monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check if running News365 version 7.0.3 or earlier and test file upload at /admin/dashboard/profile with non-image files.Check Version:
Check application files or database for version information; no standard command available.Verify Fix Applied:
After applying workarounds, attempt to upload a malicious file (e.g., .php) to verify it's blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/dashboard/profile with non-image extensions
- Large or frequent uploads from single IPs
Network Indicators:
- HTTP POST requests to /admin/dashboard/profile with file uploads
- Traffic spikes to upload endpoint
SIEM Query:
source="web_logs" AND uri="/admin/dashboard/profile" AND method="POST" AND (file_extension="php" OR file_extension="exe")