CVE-2025-15423: Phome Empirecms RCE Vulnerability

CVE-2025-15423 Overview

A vulnerability has been identified in EmpireSoft EmpireCMS versions up to 8.0 that allows unrestricted file upload through the CheckSaveTranFiletype function in the e/class/connect.php file. This flaw enables authenticated attackers to upload arbitrary files to the server remotely, potentially leading to remote code execution, web shell deployment, or server compromise.

Critical Impact

Authenticated attackers can exploit insufficient file type validation to upload malicious files, potentially enabling remote code execution on affected EmpireCMS installations.

Affected Products

• EmpireCMS versions up to 8.0
• phome empirecms (all versions prior to patched release)
• EmpireSoft EmpireCMS installations using vulnerable e/class/connect.php

Discovery Timeline

• 2026-01-02 - CVE-2025-15423 published to NVD
• 2026-01-07 - Last updated in NVD database

Technical Details for CVE-2025-15423

Vulnerability Analysis

The vulnerability resides in the CheckSaveTranFiletype function within the e/class/connect.php file of EmpireCMS. This function is responsible for validating file types during the upload process. The implementation contains insufficient validation controls that fail to properly restrict which file types can be uploaded to the server.

This unrestricted upload vulnerability (CWE-434) combined with improper access control (CWE-284) allows authenticated users to bypass intended file type restrictions. When successfully exploited, attackers can upload files with executable extensions such as PHP scripts, which can then be accessed directly on the web server to achieve remote code execution.

The attack can be launched remotely over the network and requires low privileges (authenticated user access). An exploit for this vulnerability has been publicly disclosed, increasing the risk of active exploitation in the wild.

Root Cause

The root cause of this vulnerability stems from inadequate file type validation in the CheckSaveTranFiletype function. The function fails to implement proper allowlist-based validation or performs insufficient checks on file extensions and MIME types. This allows attackers to craft malicious upload requests that bypass the intended restrictions, resulting in arbitrary file upload capabilities. The vendor was contacted about this disclosure but did not respond.

Attack Vector

The attack vector is network-based, allowing remote exploitation by authenticated users. An attacker with valid credentials can manipulate file upload requests to the vulnerable e/class/connect.php endpoint. By crafting requests that exploit the flawed CheckSaveTranFiletype validation logic, attackers can upload malicious files such as PHP web shells.

The exploitation mechanism involves:

1. Authenticating to the EmpireCMS application
2. Identifying the vulnerable file upload functionality
3. Crafting a malicious file with a bypassed extension or manipulated content type
4. Uploading the file through the vulnerable endpoint
5. Accessing the uploaded file to execute arbitrary code

Technical details and proof of concept information are available through the HxLab PoC Document and VulDB #339345 Detailed Analysis.

Detection Methods for CVE-2025-15423

Indicators of Compromise

• Unexpected PHP files or executable scripts appearing in upload directories
• Unusual POST requests to e/class/connect.php containing file upload data
• Web shells or backdoor files with recently modified timestamps in web-accessible directories
• Suspicious outbound network connections originating from the web server process

Detection Strategies

• Monitor HTTP POST requests to e/class/connect.php for anomalous file upload patterns
• Implement file integrity monitoring on web server directories to detect unauthorized file additions
• Review web server logs for successful uploads followed by direct access requests to unusual file paths
• Deploy web application firewall (WAF) rules to inspect file upload content and block suspicious extensions

Monitoring Recommendations

• Enable detailed logging for file upload operations within EmpireCMS
• Configure alerts for new executable files created in web-accessible directories
• Monitor for unusual user authentication patterns followed by file upload activity
• Implement endpoint detection to identify web shell execution behaviors on the server

How to Mitigate CVE-2025-15423

Immediate Actions Required

• Restrict access to the EmpireCMS administrative interface to trusted IP addresses only
• Review and remove any suspicious files from upload directories
• Implement additional server-side file type validation independent of EmpireCMS
• Consider disabling file upload functionality until a vendor patch is available
• Audit user accounts and remove unnecessary authenticated access

Patch Information

No official patch has been released by the vendor at this time. The vendor was contacted early about this disclosure but did not respond. Organizations should monitor the VulDB #339345 and HxLab Shared Resource pages for updates and apply patches immediately when available.

Workarounds

• Implement strict allowlist-based file extension validation at the web server level (e.g., nginx or Apache configuration)
• Deploy a web application firewall (WAF) with rules to block potentially malicious file uploads
• Restrict execution permissions on upload directories to prevent uploaded files from being executed
• Disable PHP execution in upload directories using .htaccess or server configuration
• Consider migrating to an alternative CMS platform if the vendor remains unresponsive

# Apache configuration to disable PHP execution in upload directories
<Directory "/var/www/html/empirecms/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps)$">
        Require all denied
    </FilesMatch>
</Directory>