CVE-2025-52353

CRITICAL

9.8

Description

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/26/2025

Last Modified9/9/2025

Sourcenvd

Honeypot Sightings0

Affected Products

uatech:badaso

Weaknesses (CWE)

CWE-434

References

https://github.com/uasoft-indonesia/badaso(cve@mitre.org)

https://medium.com/@pat.sanitjairak/remote-code-execution-in-a-plain-view-0f86f183543d(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.