CVE-2025-67325: QloApps File Upload RCE Vulnerability

CVE-2025-67325 Overview

CVE-2025-67325 is a critical unrestricted file upload vulnerability affecting the hotel review feature in QloApps, an open-source hotel management and booking system. This vulnerability allows remote unauthenticated attackers to upload arbitrary files, ultimately leading to remote code execution (RCE) on affected servers. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact

Remote unauthenticated attackers can achieve full remote code execution by exploiting the unrestricted file upload functionality in the hotel review feature, potentially compromising the entire web server and backend systems.

Affected Products

• QloApps version 1.7.0 and earlier
• QloApps Hotel Booking System with review feature enabled
• Web servers hosting vulnerable QloApps installations

Discovery Timeline

• 2026-01-08 - CVE-2025-67325 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67325

Vulnerability Analysis

The vulnerability exists within the hotel review feature of QloApps, where file upload functionality fails to properly validate or restrict the types of files that can be uploaded. This lack of validation allows attackers to upload malicious files, such as PHP web shells or other executable scripts, which can then be accessed directly to execute arbitrary code on the server.

The attack requires no authentication, making it particularly dangerous for internet-facing QloApps installations. Once a malicious file is uploaded and executed, an attacker gains the ability to run commands with the privileges of the web server process, potentially leading to complete system compromise, data theft, or use of the server for further attacks.

Root Cause

The root cause of this vulnerability is improper input validation in the file upload handler for the hotel review feature. The application fails to implement adequate security controls such as:

• File extension validation to restrict uploads to safe file types (e.g., images only)
• MIME type verification to confirm file content matches expected types
• Storage location restrictions to prevent uploaded files from being executed
• File content inspection to detect malicious payloads

Without these controls, the application accepts and stores files of any type, including server-side scripts that can be executed when accessed via a web request.

Attack Vector

The attack is conducted remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a vulnerable QloApps installation with the hotel review feature accessible
2. Crafting a malicious file (typically a PHP web shell) disguised or uploaded directly
3. Submitting the malicious file through the hotel review upload functionality
4. Accessing the uploaded file via its URL to trigger code execution
5. Executing arbitrary commands on the server through the web shell

Technical details and proof-of-concept information can be found in the GitHub CVE-2025-67325 Exploit repository.

Detection Methods for CVE-2025-67325

Indicators of Compromise

• Presence of unexpected PHP files or web shells in upload directories associated with hotel reviews
• Web server logs showing POST requests to review upload endpoints followed by GET requests to unusual file paths
• Files with double extensions (e.g., .php.jpg, .phtml) in upload directories
• Unexpected outbound connections or reverse shell activity originating from the web server process

Detection Strategies

• Monitor file system changes in QloApps upload directories for newly created executable files
• Implement web application firewall (WAF) rules to detect and block file upload attempts containing PHP code or other scripting languages
• Review web server access logs for suspicious patterns indicating file upload exploitation attempts
• Deploy file integrity monitoring (FIM) on web application directories to alert on unauthorized file creation

Monitoring Recommendations

• Enable verbose logging on the QloApps application and web server to capture all upload activity
• Implement real-time alerting for file creation events in upload directories with executable file extensions
• Monitor for anomalous process spawning from web server processes (e.g., www-data or apache spawning shell processes)
• Regularly scan upload directories for files that do not match expected content types

How to Mitigate CVE-2025-67325

Immediate Actions Required

• Upgrade QloApps to the latest version that addresses this vulnerability
• If immediate upgrade is not possible, disable or restrict access to the hotel review feature temporarily
• Audit existing upload directories for any suspicious or unexpected files and remove them
• Implement network-level access controls to limit exposure of the QloApps application

Patch Information

Organizations running QloApps version 1.7.0 or earlier should update to the latest patched version available from the official QloApps GitHub repository. Review the changelog and security advisories for specific patch information addressing this unrestricted file upload vulnerability.

Workarounds

• Configure the web server to prevent execution of scripts in upload directories by removing execute permissions or adding .htaccess rules that deny script execution
• Implement server-side file type validation that checks both file extensions and MIME types against an allowlist of safe types
• Store uploaded files outside the web root or in a location where direct access is blocked
• Deploy a Web Application Firewall (WAF) with rules to inspect and block malicious file uploads

# Apache .htaccess configuration to prevent script execution in upload directories
# Place this file in the QloApps upload directory
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|aspx|cgi|sh)$">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP engine entirely for the directory
php_flag engine off