CVE-2025-5178
📋 TL;DR
This critical vulnerability in Realce Tecnologia Queue Ticket Kiosk allows remote attackers to upload arbitrary files without restrictions via the /adm/ajax.php endpoint. Attackers can exploit this to upload malicious files, potentially leading to remote code execution or system compromise. All systems running Queue Ticket Kiosk up to version 20250517 are affected.
💻 Affected Systems
- Realce Tecnologia Queue Ticket Kiosk
📦 What is this software?
Queue Ticket Kiosk by Realcetecnologia
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, or ransomware deployment
Likely Case
Webshell upload enabling persistent backdoor access and lateral movement within the network
If Mitigated
File upload blocked, preventing exploitation but potentially disrupting legitimate functionality
🎯 Exploit Status
Simple file upload manipulation with no authentication required makes exploitation trivial
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to /adm/ajax.php via web server configuration or firewall rules
# Apache: <Location /adm/ajax.php> Require all denied </Location>
# Nginx: location /adm/ajax.php { deny all; }
File upload restrictions
allImplement strict file type validation and size limits for uploads
🧯 If You Can't Patch
- Isolate the Queue Ticket Kiosk system in a restricted network segment
- Implement web application firewall (WAF) rules to block malicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check if /adm/ajax.php accepts file uploads without proper validation by attempting to upload a test fileCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that file uploads to /adm/ajax.php are properly restricted or blocked📡 Detection & Monitoring
Log Indicators:
- Multiple file upload attempts to /adm/ajax.php
- Unusual file types (e.g., .php, .jsp) uploaded via POST requests
- Large or suspicious files in upload directories
Network Indicators:
- POST requests to /adm/ajax.php with file upload parameters
- Unusual outbound connections from the kiosk system
SIEM Query:
source="web_logs" AND uri="/adm/ajax.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp" OR file_extension="exe")