CVE-2025-15495
📋 TL;DR
This vulnerability in BiggiDroid Simple PHP CMS 1.0 allows attackers to upload arbitrary files via the /admin/editsite.php endpoint due to insufficient file upload restrictions. This affects all installations of Simple PHP CMS 1.0 with the admin interface accessible, potentially leading to remote code execution or system compromise.
💻 Affected Systems
- BiggiDroid Simple PHP CMS
📦 What is this software?
Simple Php Cms by Biggidroid
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data exfiltration, or ransomware deployment.
Likely Case
Malicious file upload leading to webshell installation and persistent backdoor access.
If Mitigated
File upload blocked or contained with proper input validation and file type restrictions.
🎯 Exploit Status
Exploit requires admin access; manipulation of 'image' parameter in /admin/editsite.php allows unrestricted file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure.
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative CMS or implementing workarounds.
🔧 Temporary Workarounds
Restrict file upload types
allModify editsite.php to validate file extensions and MIME types before accepting uploads.
Edit /admin/editsite.php to add file type validation (e.g., only allow .jpg, .png, .gif)
Disable admin interface
linuxRemove or restrict access to /admin/ directory if not needed.
chmod 000 /admin/editsite.php
or add authentication middleware
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file upload patterns.
- Restrict network access to admin interface using IP whitelisting or VPN.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .txt) via /admin/editsite.php image parameter.Check Version:
Check CMS version in configuration files or admin panel.Verify Fix Applied:
Test that only allowed file types can be uploaded and malicious files are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/editsite.php
- POST requests with unexpected file extensions
Network Indicators:
- HTTP POST to /admin/editsite.php with file uploads
- Subsequent requests to uploaded malicious files
SIEM Query:
source="web_logs" AND uri="/admin/editsite.php" AND method="POST" AND file_extension NOT IN ("jpg","png","gif")