PT-2025-34810 · Unknown · Badaso Cms

Pat.Sanitjairak · Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-52353

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Badaso CMS version 2.9.11

Description:

The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This was demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Unrestricted File Upload

Weakness Enumeration

CWE-94

CWE-434

Related Identifiers

CVE-2025-52353

GHSA-GQP9-JH35-439M

Affected Products

Badaso Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-52353 · Security Note
• https://osv.dev/vulnerability/GHSA-gqp9-jh35-439m · Vendor Advisory
• https://github.com/uasoft-indonesia/badaso · Note
• https://t.me/CVEtracker/30964 · Telegram Post
• https://medium.com/@pat.sanitjairak/remote-code-execution-in-a-plain-view-0f86f183543d · Note
• https://twitter.com/VulmonFeeds/status/1960471065034883202 · Twitter Post
• https://twitter.com/CVEnew/status/1960429664851091523 · Twitter Post