CVE-2025-65474
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| easyimages2.0_project | easyimages2.0 | to 2.8.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an arbitrary file rename issue in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below. It allows attackers to rename a PHP file to an SVG format, which can lead to the execution of arbitrary code.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access, data compromise, or control over the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious file rename requests to the /admin/manager.php endpoint, especially those that rename .svg files to .php files. You can look for HTTP requests with parameters 'p', 'ren', and 'to' where 'ren' ends with .svg and 'to' ends with .php. Additionally, scanning the upload directories for files with .php extensions that were previously .svg files can help detect exploitation. Example commands include using web server logs to grep for such requests: `grep '/admin/manager.php' /var/log/nginx/access.log | grep 'ren=.*\.svg' | grep 'to=.*\.php'` and searching the upload directory for suspicious PHP files: `find /path/to/upload/dir -name '*.php' -exec file {} \; | grep SVG`. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /admin/manager.php interface to trusted administrators only, implementing strict validation and authorization checks on file rename operations to prevent renaming from .svg to .php, disabling file uploads of SVG files if not necessary, and monitoring for suspicious rename requests. Additionally, updating EasyImages to a version above 2.8.6 once available or applying vendor patches is recommended. As a temporary measure, you can also block HTTP requests with parameters attempting to rename files from .svg to .php at the web server or firewall level. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious file rename requests to the /admin/manager.php endpoint, especially those renaming .svg files to .php files. You can look for HTTP requests with parameters like 'p', 'ren', and 'to' where 'ren' is an SVG file and 'to' is a PHP file. Additionally, scanning the upload directories for files with .php extensions that were originally uploaded as images (e.g., .svg) can help detect exploitation. Example commands include using web server access logs to grep for such requests: `grep '/admin/manager.php' /var/log/nginx/access.log | grep 'ren=.*\.svg' | grep 'to=.*\.php'` and searching the upload directory for suspicious PHP files: `find /path/to/upload/directory -name '*.php' -exec file {} \; | grep 'SVG'` or checking for recently renamed files. Setting up a honeypot or using the provided Docker environment to replicate the vulnerability can also aid detection. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /admin/manager.php interface to trusted administrators only, implementing strict validation and authorization checks on file rename operations to prevent renaming image files to executable PHP files, and disabling or restricting file uploads of SVG files or any files that can contain executable code. Additionally, monitoring and blocking suspicious HTTP requests that attempt to rename files from .svg to .php can help. Applying patches or upgrading EasyImages2.0 to a version above 2.8.6 once available is recommended. As a temporary measure, consider disabling the file rename functionality in the admin interface if possible. [2]