CVE-2025-7547
📋 TL;DR
This critical vulnerability in Campcodes Online Movie Theater Seat Reservation System 1.0 allows remote attackers to upload arbitrary files via the 'cover' parameter in the save_movie function. This can lead to remote code execution or system compromise. All users running version 1.0 are affected.
💻 Affected Systems
- Campcodes Online Movie Theater Seat Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, and deployment of ransomware or backdoors.
Likely Case
Webshell upload enabling persistent access, data exfiltration, and lateral movement within the network.
If Mitigated
File upload blocked, but potential for denial-of-service through resource exhaustion.
🎯 Exploit Status
Public exploit available on GitHub, simple HTTP POST request with malicious file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to /admin/admin_class.php with 'cover' parameter containing executable extensions.
WAF-specific configuration required
File Upload Restriction
linuxModify PHP configuration to restrict file uploads in the admin directory.
Add to .htaccess: php_flag engine off
Set upload_max_filesize = 0 in php.ini
🧯 If You Can't Patch
- Isolate the system in a DMZ with strict network segmentation
- Implement application allowlisting to prevent execution of uploaded files
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (e.g., test.txt) via POST to /admin/admin_class.php with 'cover' parameter.Check Version:
Check system documentation or admin panel for version information.Verify Fix Applied:
Verify file uploads to the vulnerable endpoint are blocked and return appropriate error messages.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin/admin_class.php with file uploads
- Unusual file creations in upload directories
Network Indicators:
- POST requests with file content to vulnerable endpoint
- Subsequent connections to uploaded malicious files
SIEM Query:
source="web_logs" AND uri="/admin/admin_class.php" AND method="POST" AND size>100000