PT-2025-47054 · Douphp · Douphp

Electron1C · Published 2025-11-15 · Updated 2025-11-15 · CVE-2025-13198

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DouPHP versions prior to 1.8 Release 20251022

Description A flaw exists in DouPHP that allows for unrestricted file uploads. This issue is related to the file upload component and specifically affects the file.class.php file. The File argument can be manipulated to achieve this. Remote exploitation is possible, and the exploit details have been publicly disclosed.

Recommendations Update DouPHP to version 1.8 Release 20251022 or later. As a temporary workaround, restrict access to the file upload functionality until a patch is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-13198

Affected Products

Douphp

References · 9

• 🔥 https://github.com/electroN1chahaha/My-CVE/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13198 · Security Note
• https://twitter.com/VulmonFeeds/status/1989629832888500544 · Twitter Post
• https://vuldb.com/?ctiid.332496 · Note
• https://vuldb.com/?submit.685544 · Note
• https://t.me/CVEtracker/37422 · Telegram Post
• https://t.me/cveNotify/142919 · Telegram Post
• https://vuldb.com/?id.332496 · Note
• https://twitter.com/CVEnew/status/1989627274648342642 · Twitter Post