CVE-2025-60735
📋 TL;DR
PerfreeBlog v4.0.11 contains an arbitrary file upload vulnerability in the installPlugin function that allows attackers to upload malicious files. This affects all PerfreeBlog installations running the vulnerable version. Attackers can potentially execute arbitrary code on the server.
💻 Affected Systems
- PerfreeBlog
📦 What is this software?
Perfreeblog by Perfree
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of the server.
If Mitigated
File uploads blocked or sanitized, limiting impact to denial of service or temporary disruption.
🎯 Exploit Status
File upload vulnerabilities are commonly exploited. The GitHub reference suggests detailed exploitation methods are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://perfree.org.cn/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Verify file upload functionality is secured.
🔧 Temporary Workarounds
Disable Plugin Installation
allTemporarily disable the installPlugin functionality to prevent exploitation.
# Modify PerfreeBlog configuration to disable plugin installation
# Check configuration files for installPlugin settings
Web Application Firewall Rules
linuxImplement WAF rules to block malicious file uploads.
# Example mod_security rule: SecRule FILES "@rx \.(php|asp|jsp)$" "deny"
🧯 If You Can't Patch
- Implement strict file upload validation (whitelist extensions, verify MIME types, scan for malware)
- Restrict upload directory permissions and disable script execution in upload folders
🔍 How to Verify
Check if Vulnerable:
Check if running PerfreeBlog v4.0.11. Attempt to upload a test file with dangerous extension through plugin installation.Check Version:
# Check PerfreeBlog version in admin panel or configuration filesVerify Fix Applied:
Test file upload functionality with malicious extensions - they should be rejected. Verify version is updated.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to plugin directories
- Files with executable extensions in upload folders
- Multiple failed upload attempts
Network Indicators:
- POST requests to installPlugin endpoint with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/installPlugin" OR file_extension IN ("php", "asp", "jsp", "exe"))