CVE-2018-25412: Deltasql Arbitrary File Upload RCE Flaw

CVE-2018-25412 Overview

CVE-2018-25412 is an arbitrary file upload vulnerability in DeltaSQL 1.8.2, a web-based database schema management tool. The flaw resides in docs_upload.php, which accepts unauthenticated POST requests containing multipart form data without validating file type or origin. Attackers can upload PHP files with arbitrary content to the upload directory and request them directly, achieving remote code execution under the web server context. The weakness is categorized as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated attackers can upload PHP webshells to docs_upload.php and execute arbitrary code on the host running DeltaSQL 1.8.2.

Affected Products

DeltaSQL 1.8.2 (deltasql_project:deltasql)
DeltaSQL installations exposing docs_upload.php over HTTP/HTTPS
Web servers hosting DeltaSQL with PHP execution enabled in the upload directory

Discovery Timeline

2026-05-30 - CVE-2018-25412 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database
2026-06-04 - EPSS score recorded at 0.346% (57.47 percentile)

Technical Details for CVE-2018-25412

Vulnerability Analysis

DeltaSQL 1.8.2 exposes docs_upload.php as a document upload endpoint intended for managing project documentation. The handler accepts multipart form data and writes the supplied file to a server-side upload directory. The script does not require authentication, does not verify the session, and does not restrict the file extension or MIME type. As a result, any remote client can submit a crafted POST request containing a PHP payload. Because the destination directory is served by the web server with PHP execution enabled, the uploaded file becomes immediately executable. The attacker then issues a follow-up GET request to the uploaded file URL to trigger code execution. The vendor is identified as deltasql_project and the affected component is the deltasql package at version 1.8.2.

Root Cause

The root cause is a complete absence of authentication and file validation on docs_upload.php [CWE-306]. The endpoint trusts client-supplied filenames and content, performs no extension allowlist, and stores uploads inside a web-accessible directory.

Attack Vector

Exploitation requires only network access to the DeltaSQL web interface. An attacker sends a single multipart POST request to docs_upload.php containing a PHP file, then requests that file via the upload path to execute commands. No credentials, user interaction, or prior reconnaissance beyond locating the endpoint are required. A public exploit is documented in Exploit-DB #45685 and the VulnCheck Advisory on DeltaSQL.

The vulnerability mechanism is described in prose because no sanitized exploit code is provided in the source advisories. See the referenced VulnCheck advisory for full request structure and parameter naming.

Detection Methods for CVE-2018-25412

Indicators of Compromise

POST requests to /docs_upload.php from external or unauthenticated sources in web server access logs
Presence of .php, .phtml, or .phar files in the DeltaSQL document upload directory that do not match shipped application files
Outbound network connections initiated by the PHP worker process (e.g., php-fpm, apache2) to attacker infrastructure shortly after upload activity
Web server processes spawning shell interpreters such as /bin/sh, bash, or cmd.exe

Detection Strategies

Monitor HTTP access logs for POST requests targeting docs_upload.php followed by GET requests to newly created files in the upload path
Apply file integrity monitoring to the DeltaSQL document upload directory and alert on creation of executable script files
Inspect web traffic with a WAF or IDS for multipart upload bodies containing PHP tags such as <?php or <?=

Monitoring Recommendations

Forward web server logs and host process telemetry to a centralized analytics platform for correlation between upload events and subsequent script execution
Alert on child processes of the web server user that match shell, network, or scripting binaries
Track egress connections from the DeltaSQL host to non-corporate destinations to identify post-exploitation command and control

How to Mitigate CVE-2018-25412

Immediate Actions Required

Take DeltaSQL 1.8.2 instances offline or restrict the web interface to trusted management networks until a fix is applied
Remove or rename docs_upload.php if the document upload feature is not required
Audit the upload directory for unauthorized files and remove any artifacts that are not part of the original distribution
Review web server and PHP logs for prior exploitation indicators dating back to deployment

Patch Information

No vendor patch is referenced in the available advisory data. DeltaSQL is distributed via DeltaSQL SourceForge Page and the DeltaSQL Latest Download. Operators should monitor the project page for updated releases and apply any future maintenance build that addresses authentication and upload validation in docs_upload.php. Additional remediation context is available in the VulnCheck Advisory on DeltaSQL.

Workarounds

Block external access to docs_upload.php at the reverse proxy or web server level using URL-based access control rules
Disable PHP execution within the DeltaSQL upload directory through web server configuration directives
Enforce authentication in front of the DeltaSQL application using an HTTP authentication layer or VPN-only access
Apply WAF signatures that reject multipart uploads containing PHP script markers to the affected endpoint

bash

# Example Apache configuration to block external access and disable PHP execution in the upload directory
<Location "/docs_upload.php">
    Require ip 10.0.0.0/8
</Location>

<Directory "/var/www/deltasql/uploads">
    php_admin_flag engine off
    SetHandler none
    RemoveHandler .php .phtml .phar
    Options -ExecCGI
</Directory>