CVE-2025-15262
Unrestricted File Upload in BiggiDroid CMS Site Logo Handler
Publication date: 2025-12-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| biggidroid | simple_php_cms | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a security flaw in BiggiDroid Simple PHP CMS 1.0, specifically in the /admin/edit.php file's Site Logo Handler component. It allows an attacker to manipulate the 'image' argument to perform an unrestricted file upload. This means an attacker can upload arbitrary files to the server remotely, potentially leading to further exploitation.
How can this vulnerability impact me? :
The vulnerability can allow remote attackers to upload arbitrary files without restriction, which may lead to unauthorized access, data compromise, or server takeover. This can result in loss of data integrity, confidentiality, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unrestricted upload of malicious files, potentially compromising confidentiality, integrity, and availability of the system. Such a compromise can lead to unauthorized access or data breaches, which may result in non-compliance with standards and regulations like GDPR or HIPAA that require protection of sensitive data and system security. However, no specific compliance impact is detailed in the provided resources. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for the presence of the vulnerable endpoint /admin/edit.php in BiggiDroid Simple PHP CMS 1.0 installations. One method is to use Google dorking with queries such as 'inurl:admin/edit.php' to identify potentially vulnerable targets. Additionally, monitoring for unusual file upload activity to the /admin/edit.php endpoint, especially uploads involving the 'image' argument, can help detect exploitation attempts. Specific commands could include using curl or wget to test the upload functionality manually, or scanning with web vulnerability scanners targeting arbitrary file upload vulnerabilities on that endpoint. [1]
What immediate steps should I take to mitigate this vulnerability?
Currently, no known countermeasures or mitigations exist for this vulnerability. The recommended immediate step is to replace the affected BiggiDroid Simple PHP CMS 1.0 with an alternative CMS that is not vulnerable. Additionally, restricting access to the /admin/edit.php endpoint and monitoring for suspicious upload activity may help reduce risk until a fix or patch is available. [1]