CVE-2025-52353

CriticalPublic PoC

Published: 26 August 2025

Published

26 August 2025

Modified

09 September 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0026 49.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52353 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Uatech Badaso. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of file uploads to ensure consistency and reject those with embedded PHP code bypassing content-type checks.

SI-9 Information Input Restrictions good match

prevent

Enforces restrictions on file types permitted at upload endpoints, prohibiting dangerous extensions like .php.

SI-3 Malicious Code Protection good match

preventdetect

Scans uploaded files for malicious code such as embedded PHP backdoors in PDFs before storage or execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1100 Web Shell Persistence

A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.

attack.mitre.org →

Why these techniques?

Direct RCE via unrestricted file upload to public-facing web app (T1190) resulting in web shell deployment/execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server…

executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.

Deeper analysisAI

CVE-2025-52353 is an arbitrary code execution vulnerability in Badaso CMS version 2.9.11, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue affects the Media Manager component, which permits authenticated users to upload files containing embedded PHP code via the file-upload endpoint while bypassing content-type validation. Accessing the uploaded file through its URL triggers execution of the PHP payload on the server.

An attacker with authenticated access to the Badaso CMS instance can exploit this by uploading a malicious file, such as a PDF embedding a backdoor and renamed with a .php extension. Once uploaded, accessing the file's URL causes the server to execute the embedded PHP code, allowing the attacker to run arbitrary system commands and achieve full compromise of the underlying host.

Mitigation details can be found in the referenced advisories, including the Badaso GitHub repository at https://github.com/uasoft-indonesia/badaso and a Medium disclosure post at https://medium.com/@pat.sanitjairak/remote-code-execution-in-a-plain-view-0f86f183543d. Security practitioners should monitor these sources for patches or workarounds.