CVE-2025-12223: Bdtask Flight Booking Software RCE Flaw

CVE-2025-12223 Overview

CVE-2025-12223 is an unrestricted file upload vulnerability in Bdtask Flight Booking Software through version 3.1. The flaw resides in the Package Information Module, accessed via the /b2c/package-information endpoint. An authenticated remote attacker with low privileges can manipulate the upload functionality to place arbitrary files on the server. The vendor was contacted prior to disclosure but did not respond, and a public proof-of-concept is now available. The issue is tracked under [CWE-284] Improper Access Control and [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload arbitrary files to the /b2c/package-information endpoint, with potential to compromise confidentiality, integrity, and availability of the application.

Affected Products

Bdtask Flight Booking Software versions up to and including 3.1
Package Information Module (/b2c/package-information)
Deployments exposing the B2C interface to untrusted networks

Discovery Timeline

2025-10-27 - CVE-2025-12223 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-12223

Vulnerability Analysis

The vulnerability stems from missing validation of uploaded content in the Package Information Module of Bdtask Flight Booking Software. The /b2c/package-information handler accepts file uploads without enforcing restrictions on file type, extension, or MIME content. An attacker with a low-privilege account can submit crafted upload requests to deposit attacker-controlled files into application-accessible storage.

The weakness combines two CWE categories. [CWE-434] applies because dangerous file types are not blocked at the upload boundary. [CWE-284] applies because access controls around the upload action are insufficient for the data being written. Together, these flaws allow remote, low-privilege actors to influence files used by the application. According to the EPSS model, exploitation probability is currently low, but a public proof-of-concept lowers the barrier to attack.

Root Cause

The root cause is the absence of server-side validation in the Package Information upload handler. The application does not enforce an allow-list of file extensions, verify Content-Type headers, inspect file magic bytes, or restrict the storage path. The vendor has not issued a fix or acknowledgment.

Attack Vector

The attack is launched over the network against the B2C web interface. An attacker authenticates with any low-privilege account, then issues a multipart upload request to /b2c/package-information containing a file with an attacker-chosen extension or payload. Because the exploit is publicly documented, opportunistic abuse is feasible.

No synthetic exploitation code is provided. Refer to the GitHub PoC Repository for the published proof-of-concept details.

Detection Methods for CVE-2025-12223

Indicators of Compromise

Unexpected files written to directories associated with the Package Information Module
HTTP POST requests to /b2c/package-information carrying multipart payloads with executable or script extensions such as .php, .jsp, .aspx, or .phtml
New low-privilege account activity immediately followed by upload requests to the affected endpoint
Outbound connections originating from the web server process shortly after uploads complete

Detection Strategies

Inspect web server access logs for POST requests to /b2c/package-integration and /b2c/package-information with anomalous file extensions or large bodies
Deploy web application firewall (WAF) rules that block uploads with double extensions, server-side script content, or mismatched MIME types
Monitor the application upload directory with file integrity monitoring (FIM) and alert on new files outside known media formats

Monitoring Recommendations

Forward web server, application, and authentication logs to a centralized analytics platform for correlation between login events and upload activity
Baseline normal upload volume and file types per user, and alert on deviations from that baseline
Track child processes spawned by the web server user, which can indicate execution of uploaded files

How to Mitigate CVE-2025-12223

Immediate Actions Required

Restrict network access to the /b2c/package-information endpoint using WAF policies or reverse-proxy access control lists until a vendor patch is available
Audit existing files in the Package Information upload directory and remove any non-media or unrecognized files
Rotate credentials for all low-privilege B2C accounts and review recent account creation events

Patch Information

No vendor patch is currently published. Bdtask did not respond to disclosure outreach. Organizations should monitor the VulDB advisory for any future vendor updates and contact Bdtask directly to request remediation timelines.

Workarounds

Enforce an allow-list of file extensions and MIME types at a reverse proxy or WAF in front of the application
Configure the web server so that the upload directory is non-executable, blocking interpretation of uploaded scripts
Require multi-factor authentication for B2C user accounts to raise the cost of obtaining the low-privilege access needed for exploitation
Disable or remove the Package Information Module if it is not used in production

bash

# Example nginx configuration to prevent script execution in the upload directory
location ^~ /b2c/uploads/ {
    types { }
    default_type application/octet-stream;
    location ~* \.(php|phtml|phar|jsp|aspx|cgi|pl|py|sh)$ {
        deny all;
        return 403;
    }
}