CVE-2025-63695
📋 TL;DR
DzzOffice v2.3.7 and earlier contains an arbitrary file upload vulnerability in the UEditor component that allows attackers to upload malicious files to the server. This affects all installations using vulnerable versions of DzzOffice, a collaborative office platform. Successful exploitation can lead to complete system compromise.
💻 Affected Systems
- DzzOffice
📦 What is this software?
Dzzoffice by Dzzoffice
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full server takeover, data exfiltration, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent backdoor access, file manipulation, and potential privilege escalation.
If Mitigated
Limited file system access if proper file upload restrictions and web server permissions are configured.
🎯 Exploit Status
Multiple public proof-of-concept exploits available on GitHub. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Upgrade to a version beyond v2.3.7 if released by vendor, or apply workarounds.
🔧 Temporary Workarounds
Disable vulnerable endpoint
linuxBlock or remove access to the vulnerable UEditor controller file
mv /path/to/dzz/system/ueditor/php/controller.php /path/to/dzz/system/ueditor/php/controller.php.bak
chmod 000 /path/to/dzz/system/ueditor/php/controller.php
Implement file upload restrictions
allAdd server-side validation to restrict file types and extensions
Edit controller.php to add: $allowed_ext = ['jpg','png','gif']; if(!in_array($ext, $allowed_ext)) { die('Invalid file type'); }
🧯 If You Can't Patch
- Implement WAF rules to block requests to /dzz/system/ueditor/php/controller.php with file upload parameters
- Restrict network access to DzzOffice instance using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /dzz/system/ueditor/php/controller.php and test file upload functionalityCheck Version:
Check DzzOffice version in configuration files or admin panelVerify Fix Applied:
Attempt to upload a PHP file via the UEditor endpoint - should be rejected📡 Detection & Monitoring
Log Indicators:
- POST requests to /dzz/system/ueditor/php/controller.php with file upload parameters
- Upload of files with .php, .phtml, or other executable extensions
Network Indicators:
- Unusual outbound connections from web server after file upload
- HTTP requests with file upload patterns to the vulnerable endpoint
SIEM Query:
source="web_access.log" AND uri="/dzz/system/ueditor/php/controller.php" AND method="POST" AND (file_ext=".php" OR file_ext=".phtml")