CVE-2025-67164
📋 TL;DR
An authenticated arbitrary file upload vulnerability in Pagekit CMS v1.0.18 allows attackers to upload malicious PHP files and execute arbitrary code on the server. This affects all Pagekit CMS installations running version 1.0.18 with the vulnerable /storage/poc.php component accessible. Attackers need authenticated access to exploit this vulnerability.
💻 Affected Systems
- Pagekit CMS
📦 What is this software?
Pagekit by Pagekit
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as a foothold for lateral movement within the network.
Likely Case
Webshell installation allowing persistent backdoor access, data exfiltration, and further exploitation of the server environment.
If Mitigated
Limited impact if proper file upload validation and web application firewalls are in place, though authenticated attackers could still attempt exploitation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official patch from Pagekit CMS developers
2. If patch is released, download and apply according to vendor instructions
3. Verify the /storage/poc.php component no longer accepts arbitrary file uploads
🔧 Temporary Workarounds
Remove vulnerable component
linuxDelete or rename the vulnerable poc.php file to prevent exploitation
rm /path/to/pagekit/storage/poc.php
mv /path/to/pagekit/storage/poc.php /path/to/pagekit/storage/poc.php.disabled
Restrict file upload permissions
allConfigure web server to deny execution of PHP files in upload directories
Add to .htaccess: <Files *.php> deny from all </Files>
🧯 If You Can't Patch
- Implement strict access controls and monitoring for authenticated users
- Deploy web application firewall with file upload filtering rules
🔍 How to Verify
Check if Vulnerable:
Check if Pagekit version is 1.0.18 and if /storage/poc.php endpoint exists and accepts file uploadsCheck Version:
Check Pagekit version in composer.json or admin panelVerify Fix Applied:
Attempt to upload a PHP file to /storage/poc.php - should be rejected with proper file validation📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /storage/poc.php
- PHP file creation in upload directories
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- POST requests to /storage/poc.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/storage/poc.php" OR file_extension="php") AND http_method="POST"