CVE-2025-15262
Unknown Unknown - Not Provided
Unrestricted File Upload in BiggiDroid CMS Site Logo Handler

Publication date: 2025-12-30

Last updated on: 2026-04-29

Assigner: VulDB

Description
A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-30
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-12-30
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15262
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
biggidroid simple_php_cms 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a security flaw in BiggiDroid Simple PHP CMS 1.0, specifically in the /admin/edit.php file's Site Logo Handler component. It allows an attacker to manipulate the 'image' argument to perform an unrestricted file upload. This means an attacker can upload arbitrary files to the server remotely, potentially leading to further exploitation.

Impact Analysis

The vulnerability can allow remote attackers to upload arbitrary files without restriction, which may lead to unauthorized access, data compromise, or server takeover. This can result in loss of data integrity, confidentiality, and availability.

Compliance Impact

The vulnerability allows unrestricted upload of malicious files, potentially compromising confidentiality, integrity, and availability of the system. Such a compromise can lead to unauthorized access or data breaches, which may result in non-compliance with standards and regulations like GDPR or HIPAA that require protection of sensitive data and system security. However, no specific compliance impact is detailed in the provided resources. [1, 2]

Detection Guidance

This vulnerability can be detected by searching for the presence of the vulnerable endpoint /admin/edit.php in BiggiDroid Simple PHP CMS 1.0 installations. One method is to use Google dorking with queries such as 'inurl:admin/edit.php' to identify potentially vulnerable targets. Additionally, monitoring for unusual file upload activity to the /admin/edit.php endpoint, especially uploads involving the 'image' argument, can help detect exploitation attempts. Specific commands could include using curl or wget to test the upload functionality manually, or scanning with web vulnerability scanners targeting arbitrary file upload vulnerabilities on that endpoint. [1]

Mitigation Strategies

Currently, no known countermeasures or mitigations exist for this vulnerability. The recommended immediate step is to replace the affected BiggiDroid Simple PHP CMS 1.0 with an alternative CMS that is not vulnerable. Additionally, restricting access to the /admin/edit.php endpoint and monitoring for suspicious upload activity may help reduce risk until a fix or patch is available. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart