CVE-2025-5178: Queue Ticket Kiosk RCE Vulnerability

CVE-2025-5178 Overview

A critical unrestricted file upload vulnerability has been identified in Realce Tecnologia Queue Ticket Kiosk versions up to 20250517. The vulnerability exists in the Image File Handler component, specifically within the /adm/ajax.php file. An attacker can exploit this flaw by manipulating the files[] argument to upload arbitrary files to the server, potentially leading to remote code execution.

Critical Impact
This unrestricted file upload vulnerability allows remote attackers with low privileges to upload malicious files, which could result in complete system compromise, data theft, or use of the kiosk system as a pivot point for further attacks.

Affected Products

Realce Tecnologia Queue Ticket Kiosk versions up to 20250517
Queue Ticket Kiosk Image File Handler component
Systems running the vulnerable /adm/ajax.php endpoint

Discovery Timeline

May 26, 2025 - CVE-2025-5178 published to NVD
June 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5178

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The Image File Handler component in the Queue Ticket Kiosk application fails to properly validate uploaded files, allowing attackers to bypass intended file type restrictions.

The vulnerable endpoint /adm/ajax.php accepts file uploads through the files[] parameter without adequate validation of file extensions, MIME types, or file content. This lack of validation enables attackers to upload executable scripts (such as PHP web shells) that can then be accessed directly to execute arbitrary commands on the underlying server.

The vendor, Realce Tecnologia, was contacted about this disclosure but did not respond, leaving users without an official patch at the time of publication.

Root Cause

The root cause of this vulnerability is insufficient input validation and access control in the file upload functionality. The application fails to implement proper security controls including:

File extension whitelist validation
MIME type verification against file content
Server-side content inspection
Proper access controls on the upload directory

Attack Vector

The attack can be launched remotely over the network. An attacker with low-level authenticated access can exploit this vulnerability by sending a crafted HTTP request to the /adm/ajax.php endpoint with a malicious file in the files[] parameter. The exploitation flow typically involves:

Authenticating to the application with low-privilege credentials
Crafting a multipart form request containing a malicious file (e.g., PHP web shell)
Submitting the request to the vulnerable endpoint
Accessing the uploaded file directly to execute arbitrary code

The vulnerability requires no user interaction and can be exploited with low attack complexity, making it particularly dangerous for internet-facing kiosk systems.

Detection Methods for CVE-2025-5178

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .php5) in upload directories
Web server logs showing POST requests to /adm/ajax.php with unusual files[] parameters
Presence of web shell signatures or obfuscated PHP code in uploaded files
Anomalous outbound network connections originating from the web server process

Detection Strategies

Implement file integrity monitoring (FIM) on web server directories to detect unauthorized file modifications
Configure web application firewall (WAF) rules to inspect and block suspicious file upload requests
Deploy endpoint detection solutions to monitor for web shell activity and post-exploitation behaviors
Review web server access logs for patterns indicating exploitation attempts against /adm/ajax.php

Monitoring Recommendations

Enable verbose logging on the web server to capture detailed request information for the /adm/ directory
Set up alerts for new executable files created in web-accessible directories
Monitor process execution chains originating from web server processes for anomalous behavior
Implement network traffic analysis to detect command-and-control communications from compromised systems

How to Mitigate CVE-2025-5178

Immediate Actions Required

Restrict network access to the /adm/ directory using firewall rules or web server configuration
Implement a web application firewall (WAF) with rules to block malicious file uploads
Review and remove any suspicious files that may have been uploaded to the server
Consider taking internet-facing kiosk systems offline until proper mitigations are in place
Audit user accounts and revoke unnecessary access privileges

Patch Information

At the time of publication, no official patch is available from Realce Tecnologia. The vendor was contacted about this disclosure but did not respond. Organizations should implement the workarounds listed below and monitor for vendor updates. For additional technical details, refer to the VulDB entry #310266.

Workarounds

Disable or restrict access to the /adm/ajax.php endpoint if the file upload functionality is not required
Implement strict file upload validation at the web server or reverse proxy level
Configure the upload directory to prevent script execution (e.g., via .htaccess or web server configuration)
Deploy network segmentation to isolate kiosk systems from critical infrastructure
Implement application-level controls to whitelist allowed file types and validate file content

bash

# Apache configuration to disable script execution in upload directories
# Add to .htaccess or virtual host configuration
<Directory "/path/to/upload/directory">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php5
    Options -ExecCGI
</Directory>