CVE-2025-65473
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| easyimages2.0_project | easyimages2.0 | to 2.8.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious file rename actions on the /admin/filer.php endpoint, especially renaming files from .svg to .php extensions. You can check web server logs for requests to /admin/filer.php with the action=rename parameter and unusual filename changes. Additionally, scanning for the presence of unexpected PHP files in the image upload directories (e.g., /i/2025/11/04/*.php) can indicate exploitation. Commands to detect such activity include: 1) Using grep on web server logs: `grep '/admin/filer.php?action=rename' /var/log/apache2/access.log` 2) Finding unexpected PHP files in upload directories: `find /path/to/easyimages/i -name '*.php'` 3) Monitoring for recently renamed files: `stat /path/to/easyimages/i/* | grep 'Date'` These steps help identify if the rename action has been exploited to convert SVG files into PHP web shells. [1]
Can you explain this vulnerability to me?
This vulnerability is an arbitrary file rename issue in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below. It allows attackers who have Administrator privileges to execute arbitrary code by injecting a crafted payload into the name of an uploaded file.
How can this vulnerability impact me? :
The vulnerability can lead to severe impacts including full system compromise because it allows attackers with Administrator privileges to execute arbitrary code. This can result in complete loss of confidentiality, integrity, and availability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the /admin/filer.php endpoint to trusted administrators only and ensure strong authentication is enforced. 2) Disable or restrict the file rename functionality if not necessary. 3) Implement CSRF protections such as tokens to prevent unauthorized rename requests. 4) Scan and remove any suspicious PHP files in the upload directories that may have been created by exploiting this vulnerability. 5) Update EasyImages to a version that patches this vulnerability once available. 6) Monitor logs for suspicious rename requests and unauthorized file uploads. 7) Educate administrators to avoid clicking on untrusted URLs that could trigger the rename action. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious file rename actions on the /admin/filer.php endpoint, especially renaming files from .svg to .php extensions. You can check web server logs for requests to /admin/filer.php with the action=rename parameter and look for unusual filename changes. Additionally, scanning for the presence of unexpected PHP files in the image upload directories (e.g., /i/2025/11/04/) can indicate exploitation. Commands to detect such activity include: 1) Using grep to find rename actions in logs: `grep '/admin/filer.php?action=rename' /var/log/apache2/access.log` 2) Finding PHP files in image directories: `find /path/to/easyimages/i -name '*.php'` 3) Monitoring for recent file renames: `stat /path/to/easyimages/i/* | grep 'Change'` [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the /admin/filer.php endpoint to trusted administrators only and ensure strong authentication is enforced. 2) Disable or restrict the file rename functionality if not necessary. 3) Patch or upgrade EasyImages2.0 to a version later than 2.8.6 where this vulnerability is fixed. 4) Monitor and remove any suspicious PHP files in the upload directories. 5) Educate administrators to avoid clicking on untrusted URLs that could trigger the rename action. 6) Consider implementing CSRF protections such as tokens to prevent unauthorized rename requests. [1]