CVE-2025-15187
📋 TL;DR
This vulnerability in GreenCMS allows remote attackers to perform path traversal attacks by manipulating sqlFiles or zipFiles parameters in the File Handler component. This could enable unauthorized file access or directory traversal. Only affects unsupported GreenCMS versions up to 2.3.
💻 Affected Systems
- GreenCMS
📦 What is this software?
Greencms by Njtech
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains unauthorized access to sensitive files, potentially including configuration files, credentials, or system files, leading to data exposure or system compromise.
Likely Case
Attacker reads arbitrary files from the web server, potentially accessing configuration files, source code, or other sensitive data stored within the web directory.
If Mitigated
With proper file permissions and web server restrictions, impact limited to files within the web-accessible directory structure.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available since product is no longer supported. Upgrade to a maintained CMS solution.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter path traversal sequences in sqlFiles and zipFiles parameters
Modify /DataController.class.php to sanitize user input before processing
Web Server Restrictions
allConfigure web server to restrict access to sensitive directories and files
Add appropriate .htaccess rules or nginx location blocks
🧯 If You Can't Patch
- Implement WAF rules to block path traversal patterns in requests
- Restrict network access to GreenCMS instance using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if GreenCMS version is 2.3 or earlier by examining version files or admin panelCheck Version:
Check GreenCMS version in configuration files or admin interfaceVerify Fix Applied:
Test path traversal attempts against the /DataController.class.php endpoint with sqlFiles/zipFiles parameters📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or similar path traversal sequences in sqlFiles/zipFiles parameters
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests to /DataController.class.php with suspicious parameter values
SIEM Query:
web.url:*DataController.class.php* AND (web.param:*../* OR web.param:*..\*)