CVE-2025-52130
📋 TL;DR
This vulnerability allows authenticated attackers to upload arbitrary files, including PHP scripts, to WebErpMesv2 1.17. The uploaded files can be accessed via direct GET requests, potentially leading to remote code execution on the web server. Organizations using WebErpMesv2 1.17 are affected.
💻 Affected Systems
- WebErpMesv2
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, data exfiltration, and lateral movement within the network.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a pivot point for further attacks.
If Mitigated
Limited impact if file uploads are restricted to authenticated users only and web server permissions prevent script execution.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the upload endpoint; technical details are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub repository for updates beyond 1.17
Vendor Advisory: https://github.com/SMEWebify/WebErpMesv2
Restart Required: No
Instructions:
1. Update to latest version from GitHub repository. 2. Replace app/Http/Controllers/FactoryController.php with patched version. 3. Verify file upload validation is implemented.
🔧 Temporary Workarounds
Restrict file upload extensions
ApacheConfigure web server to block execution of uploaded PHP files
Add to .htaccess: <FilesMatch "\.(php|php5|phtml)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Restrict access to upload functionality to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check if running WebErpMesv2 1.17 and examine FactoryController.php for missing file type validation.Check Version:
Check version in application configuration or README filesVerify Fix Applied:
Test file upload functionality with PHP files; they should be rejected or not executable.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to FactoryController endpoints
- Access to uploaded PHP files via GET requests
Network Indicators:
- HTTP POST requests to upload endpoints with PHP file content
- Subsequent GET requests to uploaded files
SIEM Query:
source="web_logs" AND (uri="/factory/upload" OR uri MATCHES "\.php$")