CVE-2025-1791
📋 TL;DR
CVE-2025-1791 is a critical unrestricted file upload vulnerability in Zorlan SkyCaiji 2.9 that allows remote attackers to upload arbitrary files to the server. This affects all systems running the vulnerable version of SkyCaiji, potentially leading to complete system compromise.
💻 Affected Systems
- Zorlan SkyCaiji
📦 What is this software?
Skycaiji by Skycaiji
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent backdoor access, data theft, and further exploitation of the server.
If Mitigated
Limited impact if file uploads are restricted to authenticated users only and proper file validation is in place.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict file upload functionality
allDisable or restrict the fileAction function in Tool.php to prevent unauthorized uploads
# Modify vendor/skycaiji/app/admin/controller/Tool.php to add authentication checks
# Remove or comment out fileAction function if not needed
Implement file validation
allAdd server-side file type validation and size restrictions
# Add file extension whitelisting in the upload handler
# Implement file content validation using magic bytes
🧯 If You Can't Patch
- Implement WAF rules to block suspicious file upload requests
- Restrict network access to SkyCaiji instances using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if running SkyCaiji version 2.9 and examine the Tool.php file for unrestricted upload functionalityCheck Version:
# Check SkyCaiji version in configuration files or admin interfaceVerify Fix Applied:
Test file upload functionality with malicious files to ensure proper validation is in place📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Tool.php endpoint
- Large number of POST requests to fileAction function
- Uploads of executable files like .php, .jsp, .asp
Network Indicators:
- POST requests to /vendor/skycaiji/app/admin/controller/Tool.php with file uploads
- Unusual outbound connections from the server after file uploads
SIEM Query:
source="web_logs" AND uri="/vendor/skycaiji/app/admin/controller/Tool.php" AND method="POST" AND size>1000000