CVE-2025-4305: Kefaming Mayi File Upload Vulnerability

CVE-2025-4305 Overview

CVE-2025-4305 is an unrestricted file upload vulnerability in kefaming mayi versions up to 1.3.9. The flaw resides in the Upload function within app/tools/controller/File.php. Attackers can manipulate the File argument to upload arbitrary files to the server without restriction. The vulnerability is remotely exploitable and requires only low-privileged authenticated access. Public disclosure of the exploit technique increases the likelihood of active abuse against exposed installations. The underlying weakness is classified as [CWE-284] Improper Access Control, and successful exploitation can enable remote code execution when uploaded files land in web-accessible directories.

Critical Impact
Authenticated remote attackers can upload arbitrary files, including web shells, potentially leading to remote code execution on affected servers.

Affected Products

kefaming mayi versions up to and including 1.3.9
Component: app/tools/controller/File.php
Vulnerable function: Upload

Discovery Timeline

2025-05-06 - CVE-2025-4305 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4305

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw within the mayi application, a PHP-based management system. The Upload function in app/tools/controller/File.php accepts the File argument from client input without enforcing adequate validation on file type, extension, or content. An authenticated attacker with low privileges can submit a crafted HTTP request containing an executable file such as a PHP web shell. Because the endpoint is network-reachable and the exploit has been publicly documented, opportunistic scanning against exposed instances is likely. The publicly available proof-of-concept lowers the technical barrier to abuse.

Root Cause

The root cause is improper access control combined with missing server-side validation in the file upload handler. The Upload function does not restrict the file extension, verify MIME type, or sanitize the destination path. This allows an attacker-controlled File parameter to bypass the intended upload restrictions and place arbitrary content within the web root.

Attack Vector

Exploitation occurs over the network against the vulnerable upload endpoint. An attacker authenticates with a low-privileged account and issues a multipart HTTP request containing a malicious payload. Once the file is written to a web-accessible directory, the attacker requests the uploaded resource to trigger server-side execution. Refer to the GitHub RCE Exploit Documentation and the VulDB CVE-307408 Analysis for exploitation details.

Detection Methods for CVE-2025-4305

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) appearing in upload directories managed by the mayi application.
HTTP POST requests to endpoints handled by app/tools/controller/File.php containing non-standard file types.
Outbound network connections originating from the web server process shortly after file upload activity.
New or modified files in public/ or upload directories owned by the web server user.

Detection Strategies

Monitor web server access logs for POST requests to the File upload endpoint followed by GET requests to newly created files.
Deploy file integrity monitoring on upload directories to alert on creation of scripts with executable extensions.
Inspect uploaded file magic bytes and compare against declared MIME types to identify polyglot or disguised payloads.

Monitoring Recommendations

Enable web application firewall (WAF) rules that block uploads of server-executable file types.
Correlate authentication events with subsequent upload activity to identify low-privileged accounts abusing the endpoint.
Alert on process spawning by the PHP interpreter that deviates from baseline application behavior.

How to Mitigate CVE-2025-4305

Immediate Actions Required

Restrict network access to the mayi administrative interface and upload endpoints until a patched release is available.
Audit existing upload directories for unauthorized files and remove suspicious content.
Rotate credentials for any low-privileged accounts that may have been used for exploitation.
Review web server logs for prior exploitation attempts referencing app/tools/controller/File.php.

Patch Information

At the time of publication, no vendor-supplied patch has been documented in the referenced advisories. Consult the VulDB #307408 entry and monitor the kefaming mayi project for a fixed release beyond version 1.3.9.

Workarounds

Configure the web server to deny execution of scripts within upload directories using .htaccess or equivalent server directives.
Enforce an allowlist of permitted file extensions and validate MIME types server-side before persisting uploads.
Rename uploaded files to non-executable extensions and store them outside the web root when possible.
Require elevated privileges or multi-factor authentication for any user role permitted to invoke the upload function.

bash

# Example Apache configuration to disable script execution in upload directory
<Directory "/var/www/mayi/public/uploads">
    php_flag engine off
    AddType text/plain .php .phtml .phar .php3 .php4 .php5
    <FilesMatch "\.(php|phtml|phar|php[3-5])$">
        Require all denied
    </FilesMatch>
</Directory>