CVE-2025-13238: Bdtask Flight Booking Software RCE Flaw

CVE-2025-13238 Overview

CVE-2025-13238 is an unrestricted file upload vulnerability in Bdtask Flight Booking Software version 4.0. The flaw exists in the Edit Profile Page component, specifically in the /agent/profile/edit endpoint. Authenticated agents can upload arbitrary file types because the application fails to validate uploaded content. The attack is remotely exploitable over the network and requires only low-level authentication. The vendor was contacted prior to public disclosure but did not respond. A public proof-of-concept exists, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the agent profile editor, enabling potential web shell deployment and follow-on compromise of the hosting environment.

Affected Products

Bdtask Flight Booking Software 4.0
Component: Edit Profile Page (/agent/profile/edit)
CPE: cpe:2.3:a:bdtask:flight_booking_software:4.0:*:*:*:*:*:*:*

Discovery Timeline

2025-11-16 - CVE-2025-13238 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13238

Vulnerability Analysis

The vulnerability resides in the agent profile editing functionality of Bdtask Flight Booking Software 4.0. The /agent/profile/edit handler accepts file uploads, typically intended for profile imagery, without enforcing restrictions on file type, extension, or MIME content. An authenticated agent account is sufficient to submit the request, and the attack vector is network-based with low complexity. The weakness maps to [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. Once a malicious file is stored within a web-accessible directory, the attacker can request it directly to trigger server-side execution. The EPSS score is 0.054% at the 17.23 percentile, reflecting limited observed exploitation activity at the time of publication.

Root Cause

The root cause is missing server-side validation of uploaded files in the profile edit workflow. The application does not enforce an allowlist of permitted extensions, does not verify MIME types against file content, and does not store uploads outside the web root. These omissions allow scripts such as PHP files to be written to locations where the web server will execute them.

Attack Vector

An attacker with a valid low-privilege agent account authenticates to the application, navigates to the profile edit page, and submits a crafted multipart form request containing a server-side script disguised as a profile attachment. After the upload succeeds, the attacker requests the stored file by URL to obtain command execution within the web server context. A public proof-of-concept is referenced in the GitHub PoC Vulnerability Issue and VulDB entry #332564.

No verified exploit code is reproduced here. Refer to the linked references for technical details.

Detection Methods for CVE-2025-13238

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .jsp, .aspx) in directories used for agent profile assets.
HTTP POST requests to /agent/profile/edit containing multipart payloads with non-image content types.
Outbound network connections initiated by the web server process shortly after a profile edit request.
New or modified files in upload directories without a corresponding legitimate profile change in application logs.

Detection Strategies

Inspect web server access logs for POST requests to /agent/profile/edit followed by GET requests to newly created files in profile upload paths.
Apply web application firewall rules that block uploads where the declared extension or magic bytes do not match an image format.
Monitor file integrity on directories writable by the application to flag creation of script files.

Monitoring Recommendations

Forward web server, application, and host process telemetry to a centralized analytics platform for correlation.
Alert on web server processes spawning shells, interpreters, or network utilities such as sh, bash, nc, or curl.
Track authentication events for agent accounts and correlate with file write activity on the server.

How to Mitigate CVE-2025-13238

Immediate Actions Required

Restrict network access to the application and place it behind authenticated VPN or IP allowlisting until a fix is available.
Disable or tightly control agent account registration and audit existing agent accounts for unfamiliar entries.
Review profile upload directories for unauthorized files and remove any non-image content.
Revoke and rotate credentials for any account suspected of having uploaded malicious files.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts according to the public advisory. Organizations running Bdtask Flight Booking Software 4.0 should monitor the VulDB advisory for vendor updates.

Workarounds

Configure the web server to deny script execution within the profile upload directory using Options -ExecCGI, php_flag engine off, or equivalent location directives.
Implement a reverse proxy rule that rejects uploads to /agent/profile/edit when the file extension is not .jpg, .jpeg, .png, or .gif.
Move stored uploads outside the web root and serve them through a controlled handler that enforces content-type checks.

bash

# Apache example: disable script execution in the uploads directory
<Directory "/var/www/flight_booking/uploads">
    php_flag engine off
    Options -ExecCGI
    AddType text/plain .php .phtml .php5 .pht .jsp .aspx
</Directory>