CVE-2025-15495
MEDIUMBiggiDroid Simple PHP CMS 1.0 - Unrestricted File Upload via Image Parameter in /admin/editsite.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-15495. PoCs published by Asim-QAZi.
AI-analyzed exploit summary This PoC demonstrates an arbitrary file upload vulnerability in BiggiDroid's Simple PHP Blog CMS, allowing authenticated attackers to upload a malicious PHP file disguised as an image, leading to remote code execution (RCE). The vulnerability stems from lack of file extension, MIME type, and content validation in the admin panel's logo upload functionality.
Description
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (1)
This PoC demonstrates an arbitrary file upload vulnerability in BiggiDroid's Simple PHP Blog CMS, allowing authenticated attackers to upload a malicious PHP file disguised as an image, leading to remote code execution (RCE). The vulnerability stems from lack of file extension, MIME type, and content validation in the admin panel's logo upload functionality.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L