CVE-2025-30091: Tiny MoxieManager PHP RCE Vulnerability

CVE-2025-30091 Overview

CVE-2025-30091 is a critical remote code execution vulnerability affecting Tiny MoxieManager PHP versions prior to 4.0.0. The vulnerability exists in the installer command functionality, which allows unauthenticated attackers to inject and execute arbitrary code on affected systems. Attacker-controlled data can be inserted into config.php through the InstallCommand, and critically, the InstallCommand remains accessible even after an installation has completed, creating a persistent attack surface.

Critical Impact

Unauthenticated attackers can achieve remote code execution by injecting malicious code through the installer command, potentially leading to complete server compromise.

Affected Products

• Tiny MoxieManager PHP versions prior to 4.0.0

Discovery Timeline

• 2025-03-25 - CVE-2025-30091 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2025-30091

Vulnerability Analysis

This vulnerability is classified as CWE-96: Improper Neutralization of Directives in Statically Saved Code (Static Code Injection). The core issue lies in the InstallCommand component of MoxieManager PHP, which fails to properly sanitize user-supplied input before writing it to the config.php configuration file.

The vulnerability is particularly severe because the installation command remains accessible after the initial setup is complete. This means that even on properly configured, production MoxieManager installations, an attacker can leverage the InstallCommand endpoint to inject arbitrary PHP code into the configuration file. Once injected, the malicious code executes with the privileges of the web server process whenever the configuration is loaded.

Root Cause

The root cause stems from insufficient input validation and sanitization in the InstallCommand handler. When processing installation parameters, the application directly incorporates user-supplied values into the generated config.php file without properly escaping or validating the content. This allows attackers to break out of expected configuration contexts and inject arbitrary PHP code that will be executed when the configuration file is included.

A secondary contributing factor is the failure to disable or restrict access to the installation command after the initial setup has been completed. This design flaw creates a persistent attack vector that should not exist in production environments.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft a malicious HTTP request to the InstallCommand endpoint, supplying specially crafted data designed to inject PHP code. The attack flow proceeds as follows:

1. The attacker identifies a vulnerable MoxieManager installation
2. A crafted request is sent to the installation endpoint with malicious payload embedded in configuration parameters
3. The vulnerable InstallCommand writes the attacker-controlled data directly to config.php
4. The injected PHP code executes when config.php is loaded, granting the attacker code execution on the server

This vulnerability enables attackers to execute arbitrary commands, install backdoors, access sensitive data, and potentially pivot to other systems on the network. Technical details are available in the MoxieManager Security Documentation SEC-1063.

Detection Methods for CVE-2025-30091

Indicators of Compromise

• Unexpected modifications to config.php with suspicious PHP code patterns such as eval(), system(), exec(), or base64_decode() functions
• Unusual HTTP requests targeting MoxieManager installation endpoints (/installer, /install, or similar paths)
• Web server access logs showing POST requests to installation-related endpoints on systems where installation should be complete
• New or unfamiliar files appearing in the MoxieManager directory structure

Detection Strategies

• Implement file integrity monitoring on config.php and other critical MoxieManager configuration files to detect unauthorized modifications
• Configure web application firewall (WAF) rules to detect and block requests containing PHP code injection patterns targeting installation endpoints
• Review web server access logs for suspicious activity targeting the InstallCommand endpoint, particularly from external IP addresses
• Deploy endpoint detection solutions to monitor for anomalous process spawning from web server processes

Monitoring Recommendations

• Enable detailed logging on web servers hosting MoxieManager and forward logs to a centralized SIEM for analysis
• Set up alerts for any access attempts to installation-related endpoints in production environments
• Monitor for outbound network connections from web server processes that may indicate command and control activity
• Implement regular vulnerability scanning to identify unpatched MoxieManager installations

How to Mitigate CVE-2025-30091

Immediate Actions Required

• Upgrade Tiny MoxieManager PHP to version 4.0.0 or later immediately
• If immediate upgrade is not possible, restrict network access to MoxieManager installation endpoints using firewall rules or web server configuration
• Review config.php for any signs of code injection and restore from a known good backup if compromise is suspected
• Audit web server access logs for any exploitation attempts prior to patching

Patch Information

The vendor has addressed this vulnerability in MoxieManager PHP version 4.0.0. Administrators should upgrade to this version or later to remediate the vulnerability. Detailed information about the security fix and upgrade instructions are available in the MoxieManager Changelog and the MoxieManager Security Documentation SEC-1063.

Workarounds

• Block access to the installation endpoint at the web server or reverse proxy level by denying requests to paths containing install or InstallCommand
• Implement IP-based access restrictions to limit MoxieManager administrative functions to trusted networks only
• Remove or rename installation-related PHP files if they are not needed in production environments
• Enable web application firewall rules to block requests containing PHP code patterns in POST parameters

# Example Apache configuration to block access to installation endpoint
<Location "/moxiemanager/install">
    Require all denied
</Location>

# Example Nginx configuration
location ~* /moxiemanager/install {
    deny all;
    return 403;
}