CVE-2025-15495
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| biggidroid | simple_php_cms | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15495 is an arbitrary file upload vulnerability in BiggiDroid Simple PHP CMS version 1.0, specifically in the /admin/editsite.php script. The vulnerability arises because the application does not properly validate the 'image' argument during file upload, allowing authenticated attackers to upload malicious files such as PHP web shells. These files are stored in a web-accessible directory where PHP execution is allowed, enabling attackers to execute arbitrary code remotely on the server. This flaw is due to missing server-side validation, unsafe handling of user-supplied filenames, and lack of execution restrictions on uploaded files. [1, 2, 3, 4, 5]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to remote code execution on the server hosting the CMS, allowing attackers to execute arbitrary OS commands. This can result in full system compromise, unauthorized access to sensitive data, installation of persistent backdoors, data theft, modification or deletion of application data, and service disruption. The vulnerability impacts the confidentiality, integrity, and availability of the affected system. [1, 2, 3, 4, 5]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying the presence of the vulnerable admin panel script /admin/editsite.php. One method is using Google dorking with the query: inurl:admin/editsite.php to find exposed instances. Additionally, monitoring for unusual file uploads, especially PHP files in the image upload directory, can help detect exploitation attempts. Since the vulnerability requires authentication, checking logs for authenticated sessions uploading files with suspicious extensions or names is useful. Specific commands are not provided, but searching web server directories for uploaded PHP files in image folders and reviewing web server access logs for requests to such files can aid detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting allowed file extensions to safe image types (e.g., jpg, jpeg, png, gif), implementing server-side MIME type validation, and renaming uploaded files using random UUIDs instead of user-supplied filenames. Additionally, harden the server by disabling PHP execution in the upload directories (e.g., via .htaccess or server configuration). Monitoring and restricting access to the admin panel to trusted users is also recommended. Since the vendor has not provided a fix, applying these controls manually is critical to prevent exploitation. [5]