CVE-2025-12291: Muzuro Ecommerce Auth Bypass Vulnerability

CVE-2025-12291 Overview

CVE-2025-12291 is an unrestricted file upload vulnerability affecting ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to version 1.1.0. The flaw resides in the Add Product Page component, reachable through /admin/index.php?add_product. Authenticated administrators can abuse the upload handler to place arbitrary files on the server. The issue is tracked under CWE-284: Improper Access Control. The exploit has been made public, and the vendor did not respond to disclosure attempts.

Critical Impact

An attacker with administrative access can upload arbitrary files remotely, potentially enabling web shell placement and further compromise of the hosting environment.

Affected Products

• ashymuzuro Full-Ecommece-Website up to 1.1.0
• Muzuro Ecommerce System up to 1.1.0
• Component: Add Product Page (/admin/index.php?add_product)

Discovery Timeline

• 2025-10-27 - CVE-2025-12291 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12291

Vulnerability Analysis

The vulnerability exists in the Add Product Page of the administrative interface. The endpoint /admin/index.php?add_product accepts file uploads without enforcing file type, extension, or content validation. An authenticated attacker with high privileges can upload executable content such as PHP scripts to the web root. Once placed, the uploaded file can be requested directly through the web server, resulting in server-side code execution within the application context.

The root weakness maps to CWE-284: Improper Access Control. The upload logic does not restrict what an authenticated user may submit as a product image or asset. This turns a routine administrative feature into a persistent foothold vector.

Root Cause

The product's upload handler in the Add Product workflow lacks server-side validation of MIME type, file extension allow-listing, and content inspection. It also fails to store uploads outside the web-executable directory or to rename files to non-executable extensions. Any file type submitted by an authorized session is written to a location where the web server will interpret it.

Attack Vector

The attack requires network access to the administrative interface and valid high-privilege credentials. After authenticating as an administrator, the attacker submits a crafted multipart request to /admin/index.php?add_product containing a malicious payload masquerading as a product asset. The server accepts and stores the file. The attacker then requests the stored file to trigger execution. A public exploit description is available in the GitHub File Upload Report and the VulDB entry.

Detection Methods for CVE-2025-12291

Indicators of Compromise

• New or unexpected files with executable extensions (.php, .phtml, .phar) inside product image or upload directories used by the ecommerce application.
• HTTP POST requests to /admin/index.php?add_product followed by GET requests to newly created files under the uploads path.
• Web server processes spawning shell interpreters or outbound connections shortly after admin panel activity.

Detection Strategies

• Monitor the administrative endpoint for multipart uploads containing non-image content types or double extensions such as image.jpg.php.
• Alert on file writes to web-accessible directories where the file extension does not match the expected media allow-list.
• Correlate administrative logins with subsequent file-creation events on the web server host.

Monitoring Recommendations

• Enable verbose access logging on the /admin/ path and forward logs to a centralized analytics platform for baseline deviation analysis.
• Track process lineage from the web server user account to identify child processes indicative of web shell execution.
• Review administrator account activity for logins from unusual source addresses or outside expected hours.

How to Mitigate CVE-2025-12291

Immediate Actions Required

• Restrict access to /admin/index.php to trusted management networks using firewall rules or reverse-proxy access control lists.
• Rotate all administrator credentials and enforce strong, unique passwords with multi-factor authentication where possible.
• Audit the upload directories for unexpected files and remove any executable content.

Patch Information

No vendor patch is available. The vendor was contacted about this disclosure but did not respond, according to the VulDB advisory. Operators should consider migrating to a maintained ecommerce platform if no fix is released.

Workarounds

• Configure the web server to disallow script execution within upload directories, for example by dropping .php handlers via .htaccess or an equivalent Nginx location block.
• Implement an application-layer filter that rejects uploads whose extension or MIME type is not on an image allow-list.
• Store uploaded files outside the document root and serve them through a controlled script that sets a non-executable content type.

# Example Apache configuration to block script execution in uploads
<Directory "/var/www/ecommerce/admin/uploads">
    php_flag engine off
    AddType text/plain .php .phtml .phar .php3 .php4 .php5
    <FilesMatch "\.(php|phtml|phar|php[3-7])$">
        Require all denied
    </FilesMatch>
</Directory>