PT-2025-15465 · Hax Cms · Hax Cms

Userrpr · Published 2025-04-08 · Updated 2025-06-18 · CVE-2025-32028

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 10.0.3

Description: The issue is related to the save() function in HAXCMSFile.php, which allows for unrestricted file uploads due to a non-exhaustive denylist. This list only blocks files with .php, .sh, .js, and .css extensions, causing the system to "fail open" rather than "fail closed". The vulnerability can be exploited by a remote attacker to upload files with malicious extensions and execute arbitrary code.

Recommendations: For versions prior to 10.0.3, update to version 10.0.3 to fix the vulnerability. As a temporary workaround, consider restricting access to the save() function in HAXCMSFile.php to minimize the risk of exploitation. Additionally, restrict file uploads to only necessary file types to reduce the attack surface.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-04769

CVE-2025-32028

GHSA-VJ5Q-3JV2-CG5P

Affected Products

Hax Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32028.json · Exploit
• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p · Exploit
• https://osv.dev/vulnerability/CVE-2025-32028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32028 · Security Note
• https://bdu.fstec.ru/vul/2025-04769 · Security Note
• https://t.me/cvenotify/126056 · Telegram Post
• https://twitter.com/CVEnew/status/1909649341582659998 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1909659510534185309 · Twitter Post