CVE-2025-2671: Yue Lao Blind Box Unrestricted Upload Vulnerability

CVE-2025-2671 Overview

CVE-2025-2671 is an unrestricted file upload vulnerability affecting Yue Lao Blind Box (月老盲盒) versions up to 4.0. The flaw resides in the base64image function of the /app/controller/Upload.php file. Attackers can manipulate the data argument to bypass file type restrictions and upload arbitrary content to the server. The vulnerability is exploitable remotely over the network and requires low-level privileges. Public disclosure of exploitation details has occurred, increasing the likelihood of opportunistic attacks against exposed instances. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact

Remote authenticated attackers can upload arbitrary files through the base64image endpoint, potentially leading to code execution and full application compromise.

Affected Products

• Yue Lao Blind Box (月老盲盒) versions up to and including 4.0
• Component: /app/controller/Upload.php
• Vulnerable function: base64image

Discovery Timeline

• 2025-03-23 - CVE-2025-2671 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2671

Vulnerability Analysis

The vulnerability exists in the base64image function within /app/controller/Upload.php. The function accepts a data parameter containing base64-encoded image content but fails to validate the decoded payload against permitted file types. An attacker with low-privilege access can submit crafted base64 data that the application decodes and writes to disk without adequate content or extension checks. Public technical write-ups referenced in the Jianshu Security Analysis document the exploitation path.

Root Cause

The root cause is improper access control combined with insufficient input validation on the file upload handler. The base64image function trusts client-supplied data for both file content and target extension. Without enforcing an allow-list of MIME types or scanning decoded content, the handler permits arbitrary file writes into a web-accessible directory.

Attack Vector

Exploitation occurs over the network against the application's upload endpoint. An attacker authenticates with a low-privilege account, then issues a POST request to the base64image endpoint containing a base64-encoded payload with an attacker-controlled filename and extension. The server decodes the payload and writes it to the upload directory. If the destination directory permits script execution, the uploaded file becomes reachable via a direct URL and can be invoked by the attacker.

No verified proof-of-concept code has been released alongside the CVE. Refer to the VulDB entry #300688 for additional context.

Detection Methods for CVE-2025-2671

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .jsp) appearing in the application's upload directory
• Web server access logs showing POST requests to endpoints invoking the base64image handler followed by GET requests to unusual filenames
• Outbound network connections originating from the web server process to attacker-controlled infrastructure
• New scheduled tasks, cron entries, or persistence mechanisms created by the web server user

Detection Strategies

• Monitor the /app/controller/Upload.php route for POST requests carrying large base64 data payloads with non-image content signatures
• Alert on file writes to upload directories where the file magic bytes do not match declared image formats
• Correlate authenticated session activity with subsequent access to newly created files under the upload path

Monitoring Recommendations

• Enable verbose logging on the Upload controller and forward logs to a centralized analytics platform
• Track process creation events spawned by the web server user, which typically should not launch shells or interpreters
• Baseline normal file upload volumes and alert on deviations that suggest automated abuse

How to Mitigate CVE-2025-2671

Immediate Actions Required

• Restrict network access to the Yue Lao Blind Box application until a patched version is available
• Revoke or rotate credentials for low-privilege accounts that are not strictly required
• Audit the upload directory for unauthorized files and remove any that cannot be attributed to legitimate activity
• Review web server logs for prior exploitation attempts targeting the base64image endpoint

Patch Information

No vendor patch has been referenced in the NVD data at the time of publication. Operators should monitor the project's official channels and the VulDB CTI entry #300688 for updates. Until an official fix is issued, apply the workarounds below.

Workarounds

• Implement a web application firewall rule that inspects requests to the base64image endpoint and blocks payloads whose decoded content does not match image magic bytes (FFD8FF for JPEG, 89504E47 for PNG)
• Configure the upload directory to disallow script execution at the web server level (for example, deny PHP handler mapping in that path)
• Enforce a server-side allow-list of file extensions and MIME types validated against decoded content rather than the client-declared value
• Require re-encoding of received images through a server-side image library, discarding any file that fails to parse as a valid image

# Example Apache configuration to disable script execution in the upload directory
<Directory "/var/www/app/public/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    Options -ExecCGI
    RemoveHandler .php .phtml
</Directory>