CVE-2025-12222: Bdtask Flight Booking Software RCE Flaw

CVE-2025-12222 Overview

CVE-2025-12222 is an unrestricted file upload vulnerability in Bdtask Flight Booking Software versions up to 3.1. The flaw resides in the Deposit Handler component, specifically the /admin/transaction/deposit endpoint. An authenticated attacker with low privileges can upload arbitrary files remotely without proper validation. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). A public proof-of-concept exists in the GitHub PoC Repository. The vendor was contacted but did not respond to disclosure attempts.

Critical Impact
Authenticated attackers can upload arbitrary files to the application server through the deposit transaction endpoint, potentially enabling further compromise of the booking platform.

Affected Products

Bdtask Flight Booking Software versions up to and including 3.1
Component: Deposit Handler (/admin/transaction/deposit)
Deployments exposing the administrative transaction interface to network access

Discovery Timeline

2025-10-27 - CVE-2025-12222 published to NVD with public disclosure of proof-of-concept
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-12222

Vulnerability Analysis

The vulnerability exists in the Deposit Handler functionality of Bdtask Flight Booking Software. The /admin/transaction/deposit endpoint accepts file uploads as part of deposit transaction processing. The application fails to enforce file type, extension, or content restrictions on these uploads. An attacker with valid low-privileged credentials can submit arbitrary file types, including server-executable scripts, through this interface.

The weakness combines two related issues. First, [CWE-434] reflects the absence of allow-list validation on uploaded file types. Second, [CWE-284] reflects insufficient access control over the affected operation. Together, these conditions allow a remote authenticated user to place attacker-controlled content on the server file system. The attack is initiated over the network and requires only low complexity to execute against vulnerable installations.

Root Cause

The deposit endpoint accepts uploaded files without enforcing MIME type checks, extension allow-lists, content inspection, or destination sandboxing. Access control on the administrative path does not adequately restrict who can perform sensitive upload operations relative to their privilege level.

Attack Vector

A remote attacker authenticated to the application sends a crafted multipart HTTP request to /admin/transaction/deposit containing an arbitrary file payload. Because the handler does not validate file content or extension, the uploaded file is written to a server-accessible location. Depending on the destination path and web server configuration, the file may be retrievable or executable by subsequent requests. Public proof-of-concept material is available through the GitHub PoC Repository and VulDB entry #329892.

No verified exploit code is reproduced here. Refer to the linked references for technical details.

Detection Methods for CVE-2025-12222

Indicators of Compromise

Unexpected files written under web-accessible directories used by the Bdtask deposit module, particularly files with script extensions such as .php, .phtml, or .jsp.
HTTP POST requests to /admin/transaction/deposit with multipart payloads containing non-image or non-document content types.
New or unusual administrative session activity preceding upload requests from low-privileged accounts.

Detection Strategies

Inspect web server and application access logs for POST requests to /admin/transaction/deposit and correlate with subsequent GET requests retrieving newly created files.
Monitor the application upload directory for file creations with executable extensions or content signatures that do not match expected deposit receipts.
Deploy web application firewall rules to flag multipart uploads to the deposit endpoint where the file extension or magic bytes indicate server-side scripts.

Monitoring Recommendations

Enable file integrity monitoring on directories writable by the Bdtask application process.
Forward web server, application, and authentication logs to a centralized analytics platform for correlation across upload, access, and session events.
Alert on any process spawned by the web server user that is not part of the documented application runtime.

How to Mitigate CVE-2025-12222

Immediate Actions Required

Restrict network access to the /admin/transaction/deposit endpoint to trusted administrative networks using firewall or reverse proxy rules.
Audit existing accounts and revoke unnecessary low-privileged access to the deposit module pending a fix.
Inspect upload directories for unauthorized files and remove any unrecognized content.

Patch Information

No vendor advisory or official patch is currently available. The vendor did not respond to disclosure, according to the VulDB CTI Entry #329892. Operators should treat the deployment as unsupported for this issue and apply compensating controls.

Workarounds

Place the application behind a web application firewall configured to block multipart uploads with executable extensions or scripting MIME types to the deposit endpoint.
Configure the web server to deny execution of scripts within the upload destination directory using handler restrictions or location-based rules.
Enforce strict server-side validation through a reverse proxy that inspects file extensions and content types before forwarding requests to the application.

bash

# Example nginx configuration to deny script execution in uploads directory
location ^~ /uploads/ {
    location ~* \.(php|phtml|phar|jsp|asp|aspx|cgi)$ {
        deny all;
        return 403;
    }
}

# Restrict access to the deposit endpoint to internal admin network
location = /admin/transaction/deposit {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://backend;
}