CVE-2025-7895
📋 TL;DR
This critical vulnerability in MoneyPrinterTurbo allows remote attackers to upload arbitrary files without restrictions via the upload_bgm_file function. Attackers can exploit this to upload malicious files, potentially leading to remote code execution or system compromise. All users running MoneyPrinterTurbo versions up to 1.2.6 are affected.
💻 Affected Systems
- harry0703 MoneyPrinterTurbo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, or deployment of ransomware.
Likely Case
Upload of web shells or malicious scripts enabling persistent access, data exfiltration, or lateral movement.
If Mitigated
File uploads blocked or restricted to safe extensions only, preventing exploitation.
🎯 Exploit Status
Exploitation appears straightforward based on vulnerability description, but no public proof-of-concept has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: Yes
Instructions:
1. Monitor the MoneyPrinterTurbo GitHub repository for security updates. 2. Apply any available patch when released. 3. Restart the MoneyPrinterTurbo service after patching.
🔧 Temporary Workarounds
Restrict File Upload Extensions
allConfigure the application to only allow specific safe file extensions for uploads.
Modify app/controllers/v1/video.py to implement strict file extension validation
Implement File Upload Sanitization
allAdd server-side validation to check file content and rename uploaded files.
Add file type verification and random filename generation in upload_bgm_file function
🧯 If You Can't Patch
- Disable the vulnerable upload_bgm_file functionality entirely if not required.
- Implement network segmentation to isolate MoneyPrinterTurbo instances from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check MoneyPrinterTurbo version; if version is 1.2.6 or earlier, the system is vulnerable.Check Version:
Check the application configuration or package manager for MoneyPrinterTurbo version.Verify Fix Applied:
Verify that file uploads are properly restricted and validated after applying workarounds.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to upload_bgm_file endpoint
- Uploads of executable files or scripts
Network Indicators:
- HTTP POST requests to /v1/video/upload_bgm_file with suspicious file types
SIEM Query:
source="moneyprinterturbo" AND (uri_path="/v1/video/upload_bgm_file" AND file_extension IN ("php", "exe", "sh", "py"))