CVE-2025-5178: Queue Ticket Kiosk RCE Vulnerability

CVE-2025-5178 Overview

A critical unrestricted file upload vulnerability has been identified in Realce Tecnologia Queue Ticket Kiosk versions up to 20250517. The vulnerability exists in the Image File Handler component, specifically within the /adm/ajax.php file. An attacker can exploit this flaw by manipulating the files[] argument to upload arbitrary files to the server, potentially leading to remote code execution.

Critical Impact

This unrestricted file upload vulnerability allows remote attackers with low privileges to upload malicious files, which could result in complete system compromise, data theft, or use of the kiosk system as a pivot point for further attacks.

Affected Products

• Realce Tecnologia Queue Ticket Kiosk versions up to 20250517
• Queue Ticket Kiosk Image File Handler component
• Systems running the vulnerable /adm/ajax.php endpoint

Discovery Timeline

• May 26, 2025 - CVE-2025-5178 published to NVD
• June 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5178

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The Image File Handler component in the Queue Ticket Kiosk application fails to properly validate uploaded files, allowing attackers to bypass intended file type restrictions.

The vulnerable endpoint /adm/ajax.php accepts file uploads through the files[] parameter without adequate validation of file extensions, MIME types, or file content. This lack of validation enables attackers to upload executable scripts (such as PHP web shells) that can then be accessed directly to execute arbitrary commands on the underlying server.

The vendor, Realce Tecnologia, was contacted about this disclosure but did not respond, leaving users without an official patch at the time of publication.

Root Cause

The root cause of this vulnerability is insufficient input validation and access control in the file upload functionality. The application fails to implement proper security controls including:

• File extension whitelist validation
• MIME type verification against file content
• Server-side content inspection
• Proper access controls on the upload directory

Attack Vector

The attack can be launched remotely over the network. An attacker with low-level authenticated access can exploit this vulnerability by sending a crafted HTTP request to the /adm/ajax.php endpoint with a malicious file in the files[] parameter. The exploitation flow typically involves:

1. Authenticating to the application with low-privilege credentials
2. Crafting a multipart form request containing a malicious file (e.g., PHP web shell)
3. Submitting the request to the vulnerable endpoint
4. Accessing the uploaded file directly to execute arbitrary code

The vulnerability requires no user interaction and can be exploited with low attack complexity, making it particularly dangerous for internet-facing kiosk systems.

Detection Methods for CVE-2025-5178

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .php5) in upload directories
• Web server logs showing POST requests to /adm/ajax.php with unusual files[] parameters
• Presence of web shell signatures or obfuscated PHP code in uploaded files
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Implement file integrity monitoring (FIM) on web server directories to detect unauthorized file modifications
• Configure web application firewall (WAF) rules to inspect and block suspicious file upload requests
• Deploy endpoint detection solutions to monitor for web shell activity and post-exploitation behaviors
• Review web server access logs for patterns indicating exploitation attempts against /adm/ajax.php

Monitoring Recommendations

• Enable verbose logging on the web server to capture detailed request information for the /adm/ directory
• Set up alerts for new executable files created in web-accessible directories
• Monitor process execution chains originating from web server processes for anomalous behavior
• Implement network traffic analysis to detect command-and-control communications from compromised systems

How to Mitigate CVE-2025-5178

Immediate Actions Required

• Restrict network access to the /adm/ directory using firewall rules or web server configuration
• Implement a web application firewall (WAF) with rules to block malicious file uploads
• Review and remove any suspicious files that may have been uploaded to the server
• Consider taking internet-facing kiosk systems offline until proper mitigations are in place
• Audit user accounts and revoke unnecessary access privileges

Patch Information

At the time of publication, no official patch is available from Realce Tecnologia. The vendor was contacted about this disclosure but did not respond. Organizations should implement the workarounds listed below and monitor for vendor updates. For additional technical details, refer to the VulDB entry #310266.

Workarounds

• Disable or restrict access to the /adm/ajax.php endpoint if the file upload functionality is not required
• Implement strict file upload validation at the web server or reverse proxy level
• Configure the upload directory to prevent script execution (e.g., via .htaccess or web server configuration)
• Deploy network segmentation to isolate kiosk systems from critical infrastructure
• Implement application-level controls to whitelist allowed file types and validate file content

# Apache configuration to disable script execution in upload directories
# Add to .htaccess or virtual host configuration
<Directory "/path/to/upload/directory">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php5
    Options -ExecCGI
</Directory>