CVE-2025-13815: Mogublog RCE Vulnerability via File Upload

CVE-2025-13815 Overview

CVE-2025-13815 is a medium-severity unrestricted file upload vulnerability identified in moxi159753 Mogu Blog v2 up to version 5.2. The vulnerability exists in an unknown function of the file /file/pictures, where manipulation of the filedatas argument allows attackers to upload arbitrary files without proper validation or restrictions. This weakness can be exploited remotely by authenticated attackers, potentially leading to remote code execution, web shell deployment, or server compromise.

Critical Impact

This unrestricted upload vulnerability allows authenticated attackers to upload malicious files to the server via the /file/pictures endpoint, potentially leading to remote code execution or complete server takeover.

Affected Products

• Mogu Blog v2 up to version 5.2
• mogublog_project mogublog (all versions up to and including 5.2)

Discovery Timeline

• 2025-12-01 - CVE-2025-13815 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-13815

Vulnerability Analysis

The vulnerability resides in the file upload functionality of Mogu Blog v2, specifically within the /file/pictures endpoint. The application fails to properly validate or restrict file uploads when processing the filedatas argument. This improper access control (CWE-284) allows attackers to bypass intended security restrictions and upload files of any type to the server.

The CVSS 4.0 score is 5.3 (Medium) with the vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The EPSS (Exploit Prediction Scoring System) probability is 0.039% (11.6th percentile), indicating a relatively low probability of exploitation in the wild, though a public proof-of-concept exists.

Root Cause

The root cause of this vulnerability is improper access control and missing input validation on file upload operations. The /file/pictures endpoint does not adequately verify the type, content, or extension of uploaded files through the filedatas parameter. This lack of server-side validation allows attackers to upload executable files, web shells, or other malicious content that should otherwise be rejected.

Attack Vector

The attack can be initiated remotely over the network by an authenticated user. An attacker with low-privilege access to the Mogu Blog application can exploit this vulnerability by:

1. Authenticating to the Mogu Blog application with valid credentials
2. Crafting a malicious HTTP POST request to the /file/pictures endpoint
3. Manipulating the filedatas argument to include malicious file content (e.g., a PHP web shell or JSP backdoor)
4. Bypassing any client-side file type restrictions
5. Executing the uploaded malicious file to gain server access

The vulnerability mechanism involves sending crafted multipart form-data requests to the vulnerable endpoint. Since the server does not properly validate uploaded files, attackers can upload executable scripts that may be accessible via the web server and executed to achieve remote code execution. For technical details and a proof-of-concept, see the security researcher's report.

Detection Methods for CVE-2025-13815

Indicators of Compromise

• Unexpected files appearing in upload directories, particularly executable files (.php, .jsp, .aspx, .sh)
• HTTP POST requests to /file/pictures containing suspicious file extensions or content
• Web shell activity or reverse shell connections originating from the Mogu Blog server
• Unusual process execution from web server user accounts
• Modified timestamps on files in upload directories

Detection Strategies

Organizations can detect potential exploitation attempts by:

1. Web Application Firewall (WAF) Rules: Configure rules to inspect file upload requests to /file/pictures for dangerous file extensions and content patterns
2. Log Analysis: Monitor web server access logs for POST requests to the vulnerable endpoint with unusual file names or extensions
3. File Integrity Monitoring: Implement monitoring on upload directories to detect new or modified executable files
4. Network Traffic Analysis: Look for suspicious outbound connections from the web server that may indicate web shell activity
5. Endpoint Detection: Deploy endpoint protection to detect execution of uploaded malicious files

Monitoring Recommendations

• Enable detailed logging for the Mogu Blog application, particularly for file upload operations
• Configure alerting for any executable file uploads or uploads with double extensions (e.g., image.php.jpg)
• Monitor for MIME type mismatches in uploaded files
• Track authentication events to identify potential compromised accounts used in attacks
• Implement real-time file scanning on upload directories

How to Mitigate CVE-2025-13815

Immediate Actions Required

• Restrict access to the /file/pictures endpoint to only trusted administrators
• Implement server-side file type validation based on file content (magic bytes), not just extensions
• Configure the web server to prevent execution of scripts in upload directories
• Apply network segmentation to limit access to the vulnerable application
• Review and audit existing uploaded files for any malicious content

Patch Information

The vendor (moxi159753/mogublog_project) was contacted about this vulnerability but did not respond. As of the last update on 2025-12-03, no official patch has been released. Organizations using Mogu Blog v2 up to version 5.2 should implement the workarounds described below until an official fix is available.

For more information, refer to the VulDB entry for this vulnerability.

Workarounds

Since no official patch is available, the following workarounds should be implemented:

Restrict upload functionality by configuring your web server to deny script execution in upload directories. For example, in Nginx, add the following to your configuration:

# Disable script execution in upload directories
location /uploads {
    location ~ \.(php|jsp|aspx|cgi|pl|py|sh)$ {
        deny all;
    }
}

For Apache, use .htaccess in the upload directory:

# Prevent script execution
<FilesMatch "\.(php|jsp|aspx|cgi|pl|py|sh)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Additionally, consider implementing a whitelist-based approach for allowed file types and integrating server-side content validation that checks file headers rather than relying solely on file extensions.