CVE-2025-34097
HIGHProcessMaker < 3.5.4 - Authenticated Remote Code Execution via Plugin Upload
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-34097.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/processmaker_plugin_upload.
AI-analyzed exploit summary This Metasploit module exploits an authenticated plugin upload vulnerability in ProcessMaker to achieve remote code execution (RCE) by uploading a malicious PHP plugin. The exploit generates a tar file containing the payload, uploads it, and triggers execution during installation.
Description
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
Exploits (2)
This Metasploit module exploits an authenticated plugin upload vulnerability in ProcessMaker to achieve remote code execution (RCE) by uploading a malicious PHP plugin. The exploit generates a tar file containing the payload, uploads it, and triggers execution during installation.
This Metasploit module exploits a plugin upload vulnerability in ProcessMaker to achieve remote code execution (RCE) as the web server user. It authenticates with provided credentials, uploads a malicious plugin containing PHP payload, and triggers execution during installation.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N