CVE-2025-0463: Lingdang CRM RCE Vulnerability

CVE-2025-0463 Overview

A critical unrestricted file upload vulnerability has been discovered in Shanghai Lingdang Information Technology Lingdang CRM up to version 8.6.0.0. The vulnerability exists in the file /crm/weixinmp/index.php and allows remote attackers to upload arbitrary files by manipulating the name argument. This vulnerability can be exploited remotely with low privileges, potentially enabling attackers to upload malicious files such as web shells for remote code execution.

Critical Impact

Attackers with low-level access can exploit this unrestricted file upload vulnerability to upload arbitrary files to the CRM server, potentially leading to remote code execution and complete system compromise.

Affected Products

• 51mis Lingdang CRM version 8.6.0.0 and earlier
• Shanghai Lingdang Information Technology Lingdang CRM

Discovery Timeline

• 2025-01-14 - CVE-2025-0463 published to NVD
• 2025-08-28 - Last updated in NVD database

Technical Details for CVE-2025-0463

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The affected component is the WeChat mini-program integration module located at /crm/weixinmp/index.php. The endpoint accepts file uploads through the name parameter without properly validating the file type, content, or extension.

The vulnerability allows authenticated users with low privileges to bypass file upload restrictions entirely. Due to the lack of proper input validation on uploaded files, attackers can submit malicious content disguised as legitimate files. This could include PHP web shells, executable scripts, or other dangerous file types that can be executed by the web server.

Root Cause

The root cause stems from improper access control (CWE-284) combined with the lack of file type validation (CWE-434) in the upload handling functionality. The application fails to:

1. Validate file extensions against a whitelist of allowed types
2. Verify file content matches the declared file type
3. Sanitize the uploaded filename properly
4. Restrict upload directories or enforce proper permissions

Attack Vector

The attack can be performed remotely over the network with low complexity. An attacker with low-level privileges can craft a malicious HTTP request to the vulnerable endpoint at /crm/weixinmp/index.php with specific parameters including userid=123, module=Users, usid=1, action=UsersAjax, minipro_const_type=1, and related_module=Singin. By manipulating the name argument, the attacker can upload arbitrary files such as PHP web shells, which can then be accessed to execute commands on the server.

The vulnerability has been publicly disclosed and the exploit details are available through the GitHub File Upload Vulnerability Document. The vendor was contacted about this disclosure but did not respond.

Detection Methods for CVE-2025-0463

Indicators of Compromise

• Unexpected file uploads in web-accessible directories, particularly PHP files or executable scripts
• HTTP POST requests to /crm/weixinmp/index.php with suspicious name parameter values containing file extensions like .php, .phtml, or .asp
• New or modified files in upload directories with recent timestamps
• Web server logs showing access to unusual file paths following upload requests

Detection Strategies

• Monitor HTTP traffic for POST requests to the vulnerable endpoint /crm/weixinmp/index.php with action=UsersAjax parameters
• Implement file integrity monitoring on web-accessible directories to detect unauthorized file uploads
• Deploy web application firewall (WAF) rules to block file uploads with dangerous extensions
• Review web server access logs for sequential requests showing upload followed by file access attempts

Monitoring Recommendations

• Enable detailed logging for all file upload operations in the Lingdang CRM application
• Set up alerts for new executable files appearing in web directories
• Monitor for unusual outbound network connections that may indicate web shell activity
• Implement regular security scans of upload directories for malicious content

How to Mitigate CVE-2025-0463

Immediate Actions Required

• Restrict access to the vulnerable endpoint /crm/weixinmp/index.php via web server configuration or firewall rules
• Implement strict file type validation at the application level until a vendor patch is available
• Review and remove any suspicious files from upload directories
• Consider disabling the WeChat mini-program integration module if not required

Patch Information

No official patch is currently available from the vendor. Shanghai Lingdang Information Technology was contacted about this vulnerability but did not respond. Users should monitor for updates from 51mis and apply patches as soon as they become available. Additional technical details can be found in the VulDB CVE-291480 Report and VulDB #291480.

Workarounds

• Configure web server rules to block execution of uploaded files by removing execute permissions from upload directories
• Implement server-side file type validation using magic bytes verification rather than relying on file extensions
• Restrict upload functionality to authenticated administrators only
• Deploy a reverse proxy or WAF to filter malicious upload requests targeting the vulnerable endpoint

# Apache configuration to disable PHP execution in upload directories
<Directory /path/to/crm/uploads>
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</Directory>

# Nginx configuration to block PHP execution
location ~* /uploads/.*\.php$ {
    deny all;
}