CVE-2025-65657: 
PHP vulnerability analysis and mitigation

CVE-2025-65657 is a Remote Code Execution (RCE) vulnerability in FeehiCMS version 2.1.1 caused by unrestricted file upload in the Ad Management module. Authenticated remote attackers can upload a crafted PHP file that the web server executes without sufficient validation or sanitization. The vulnerability was disclosed on December 2, 2025, and affects FeehiCMS versions up to and including 2.1.1 (Composer package feehi/cms). It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though the original researcher assessed it at 9.6 (Critical), and a CVSS v4 score of 6.8 (Moderate) per the GitHub Advisory (Github Advisory, RedHat CVE).

The root cause is improper input validation (CWE-20) and improper neutralization of special elements in a command (CWE-77) in the Ad Management file upload handler. The application fails to enforce file type restrictions server-side, allowing an attacker to bypass client-side or extension-based checks by intercepting a legitimate image upload request and replacing the file extension (e.g., .jpeg → .php) and content with a PHP webshell. The uploaded file is stored in a web-accessible, executable location, enabling direct HTTP-triggered code execution. The attack targets the endpoint POST /admin/index.php?r=ad%2Fupdate&id=<id> using a multipart form-data request (Github Issue, PoC Write-up).

Successful exploitation allows an authenticated attacker to execute arbitrary system commands on the web server with the privileges of the web server process. This can lead to full system compromise, unauthorized access to sensitive data stored on the server, deployment of persistent backdoors or webshells, and potential lateral movement within the hosting environment. Confidentiality, integrity, and availability of the affected system are all at high risk once a webshell is deployed (Github Advisory, Github Issue).

Public proof-of-concept (PoC) exploit code and a detailed write-up are available on GitHub, lowering the barrier for exploitation significantly (PoC Write-up, Github Issue). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.105% (26th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid backend credentials, which limits the attack surface to authenticated users or attackers who have obtained credentials through other means (Github Advisory).

1. Obtain Backend Credentials: Acquire valid FeehiCMS backend user credentials through phishing, credential stuffing, or other means.
2. Authenticate: Log in to the FeehiCMS admin panel at /admin/index.php.
3. Navigate to Ad Management: Go to the Ad Management section and select an existing ad entry to edit (e.g., ?r=ad%2Fupdate&id=28).
4. Initiate a Legitimate Upload: Upload a valid JPEG image file through the ad form and intercept the HTTP request using a proxy tool such as Burp Suite.
5. Modify the Request: In the intercepted multipart/form-data POST request, change the filename from 2.jpeg to 2.php and replace the file content with a PHP webshell payload (e.g., <?php system($_GET['cmd']); ?>).
6. Submit the Modified Request: Forward the modified request to the server. The application accepts the file without proper validation and stores it in a web-accessible directory.
7. Identify the Upload Path: Observe the server response or the backend UI to determine the path where the uploaded PHP file was stored.
8. Execute Commands: Access the uploaded PHP file via the browser (e.g., http://target/uploads/path/2.php?cmd=id) to execute arbitrary system commands on the server (Github Issue, PoC Write-up).

• Network: Unusual POST requests to /admin/index.php?r=ad%2Fupdate with multipart/form-data content containing .php file extensions; subsequent GET requests to upload directories (e.g., /uploads/) for .php files from external IPs.
• File System: Unexpected .php files in the CMS upload or ad media directories (e.g., /uploads/ad/, /web/uploads/); webshell files with names like 2.php or random strings with PHP content such as <?php system(.
• Logs: Web server access logs showing POST requests to the ad update endpoint followed by GET requests to the same uploaded file path; PHP error logs indicating execution of uploaded scripts.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., sh, bash, curl, wget, python) executing system commands (Github Issue).

As of the GitHub Advisory publication, no patched version of FeehiCMS has been released (all versions ≤ 2.1.1 are listed as affected with no patched version noted). Administrators should apply the following mitigations immediately: (1) implement strict server-side file type allowlisting based on magic bytes rather than file extension or client-supplied MIME type; (2) store uploaded files outside the web root or in directories configured with noexec permissions; (3) configure the web server to deny execution of scripts in upload directories; (4) generate server-side filenames (e.g., UUIDs) to prevent predictable file paths; (5) monitor and log all file upload activity for anomalies. Restricting access to the admin panel to trusted IP ranges can also reduce exposure (Github Advisory, Github Issue).

The vulnerability was reported by researcher kiwi865 via a GitHub issue on the FeehiCMS repository on October 2, 2025, and formally published as a CVE on December 2, 2025. No official vendor patch or public statement from the FeehiCMS maintainer has been issued as of the advisory date. The vulnerability received automated tracking coverage from ENISA (EUVD-2025-200325) and RedHat's CVE database, but no significant broader media coverage or notable researcher commentary beyond the original PoC disclosure has been observed (Github Issue, RedHat CVE).