CVE-2025-5714
📋 TL;DR
This CVE describes a path traversal vulnerability in SoluçõesCoop iSoluçõesWEB's profile update component. Attackers can manipulate the 'nomeArquivo' parameter in /sys/up.upload.php to access files outside intended directories. Organizations using iSoluçõesWEB up to version 20250516 are affected.
💻 Affected Systems
- SoluçõesCoop iSoluçõesWEB
📦 What is this software?
Solucoescoop by Isolucoesweb
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, potentially exposing credentials, configuration data, or other confidential information stored on the server.
Likely Case
Unauthorized file reading of web-accessible directories, potentially exposing user data, configuration files, or application source code.
If Mitigated
Limited impact with proper file permissions and web server configuration restricting access to sensitive directories.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 20250516
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Upgrade iSoluçõesWEB to version after 20250516. 2. Apply vendor-provided patches if available. 3. Verify the /sys/up.upload.php file has been updated.
🔧 Temporary Workarounds
Restrict file upload directory access
allConfigure web server to block directory traversal attempts and restrict access to upload directories
# Apache: Add to .htaccess or virtual host config
<Files "up.upload.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /sys/up\.upload\.php$ {
deny all;
}
Input validation filter
allAdd input validation to sanitize 'nomeArquivo' parameter before processing
# PHP example for input sanitization
$fileName = basename($_POST['nomeArquivo']);
$fileName = preg_replace('/[^a-zA-Z0-9._-]/', '', $fileName);
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns like '../' and '..\' in requests
- Disable or restrict access to the /sys/up.upload.php endpoint using network access controls
🔍 How to Verify
Check if Vulnerable:
Test if accessing /sys/up.upload.php with traversal payloads (e.g., '../../etc/passwd') returns sensitive filesCheck Version:
Check iSoluçõesWEB version in admin panel or configuration filesVerify Fix Applied:
Attempt exploitation with same payloads after patching - should return error or sanitized output📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /sys/up.upload.php containing '../' or '..\' patterns
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests with traversal sequences in POST parameters
- Abnormal response sizes from upload endpoint
SIEM Query:
source="web_logs" AND uri="/sys/up.upload.php" AND (payload="../" OR payload="..\\")