CVE-2025-15455: 1234n Minicms Auth Bypass Vulnerability

CVE-2025-15455 Overview

CVE-2025-15455 is an improper authentication vulnerability [CWE-287] in bg5sbk MiniCMS through version 1.8. The flaw resides in the delete_page function of /minicms/mc-admin/page.php, part of the File Recovery Request Handler component. Remote attackers can manipulate the function to delete pages without proper authentication checks. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed MiniCMS deployments. The vendor was contacted prior to public disclosure but did not respond.

Critical Impact

Remote unauthenticated attackers can invoke administrative page deletion functionality, leading to unauthorized content removal and integrity loss on affected MiniCMS sites.

Affected Products

• bg5sbk MiniCMS versions up to and including 1.8
• /minicms/mc-admin/page.php File Recovery Request Handler component
• Self-hosted MiniCMS deployments exposed to untrusted networks

Discovery Timeline

• 2026-01-05 - CVE-2025-15455 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-15455

Vulnerability Analysis

The vulnerability stems from missing authentication enforcement in the delete_page function within /minicms/mc-admin/page.php. MiniCMS is a lightweight PHP-based content management system, and administrative endpoints under mc-admin/ are expected to validate an authenticated session before executing privileged operations. In affected versions, the page deletion handler does not perform this check correctly, allowing unauthenticated HTTP requests to trigger destructive actions. This maps to [CWE-287] Improper Authentication.

The issue carries a network attack vector with low complexity and requires no user interaction or prior privileges. Successful exploitation does not directly expose confidentiality, but it impacts integrity and availability through unauthorized deletion of content pages managed by the CMS.

Root Cause

The root cause is the absence or improper implementation of session and privilege validation in the delete_page handler. Administrative actions in mc-admin/page.php should verify that the requestor holds a valid administrator session token before performing state-changing operations. Without this enforcement, the handler trusts request parameters and executes deletion logic directly.

Attack Vector

An attacker reaches the vulnerable endpoint over HTTP or HTTPS by issuing crafted requests to /minicms/mc-admin/page.php with parameters that invoke the delete_page action. Because authentication is not enforced, the request succeeds from any unauthenticated client on the network. The exploit has been published, and full technical detail is available through the GitHub Issue Discussion and the VulDB Entry #339488.

Detection Methods for CVE-2025-15455

Indicators of Compromise

• HTTP requests to /minicms/mc-admin/page.php containing delete_page action parameters originating from clients without an authenticated administrator session cookie.
• Unexpected removal of CMS pages from the MiniCMS content store without corresponding administrator login events.
• Web server access logs showing administrative endpoint hits from unusual IP addresses or user agents.

Detection Strategies

• Monitor web server logs for requests to mc-admin/page.php and correlate with the presence of valid session cookies.
• Alert on state-changing HTTP methods (POST, GET with delete parameters) targeting administrative paths from external IPs.
• Compare CMS page inventories on a scheduled basis and flag deletions that lack a corresponding authenticated audit trail.

Monitoring Recommendations

• Forward web server access and error logs to a centralized logging platform for query and retention.
• Track baseline volumes of requests to mc-admin/ endpoints and alert on deviations.
• Audit file system timestamps on MiniCMS content directories for unexpected modifications.

How to Mitigate CVE-2025-15455

Immediate Actions Required

• Restrict access to /minicms/mc-admin/ paths using web server access controls, allowlisting only trusted administrator IP ranges.
• Place MiniCMS behind a VPN or authenticated reverse proxy until a vendor patch is available.
• Take regular backups of MiniCMS content directories to enable recovery if pages are deleted.
• Review existing pages and access logs for signs of unauthorized deletion since deployment.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure outreach according to the VulDB CTI Entry #339488. Affected operators should track the upstream project for security updates and consider migrating to an actively maintained CMS if no fix materializes.

Workarounds

• Enforce HTTP Basic Authentication or mTLS at the web server level for all /minicms/mc-admin/ URIs as a defense-in-depth layer.
• Block direct internet exposure of the administrative interface using firewall rules.
• Apply a web application firewall rule to deny unauthenticated requests carrying delete_page parameters to page.php.

# Example nginx configuration restricting access to MiniCMS admin endpoints
location /minicms/mc-admin/ {
    allow 10.0.0.0/8;        # trusted admin network
    deny all;
    auth_basic "MiniCMS Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
}