CVE-2025-67325: QloApps File Upload RCE Vulnerability

CVE-2025-67325 Overview

CVE-2025-67325 is a critical unrestricted file upload vulnerability affecting the hotel review feature in QloApps, an open-source hotel management and booking system. This vulnerability allows remote unauthenticated attackers to upload arbitrary files, ultimately leading to remote code execution (RCE) on affected servers. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Remote unauthenticated attackers can achieve full remote code execution by exploiting the unrestricted file upload functionality in the hotel review feature, potentially compromising the entire web server and backend systems.

Affected Products

QloApps version 1.7.0 and earlier
QloApps Hotel Booking System with review feature enabled
Web servers hosting vulnerable QloApps installations

Discovery Timeline

2026-01-08 - CVE-2025-67325 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67325

Vulnerability Analysis

The vulnerability exists within the hotel review feature of QloApps, where file upload functionality fails to properly validate or restrict the types of files that can be uploaded. This lack of validation allows attackers to upload malicious files, such as PHP web shells or other executable scripts, which can then be accessed directly to execute arbitrary code on the server.

The attack requires no authentication, making it particularly dangerous for internet-facing QloApps installations. Once a malicious file is uploaded and executed, an attacker gains the ability to run commands with the privileges of the web server process, potentially leading to complete system compromise, data theft, or use of the server for further attacks.

Root Cause

The root cause of this vulnerability is improper input validation in the file upload handler for the hotel review feature. The application fails to implement adequate security controls such as:

File extension validation to restrict uploads to safe file types (e.g., images only)
MIME type verification to confirm file content matches expected types
Storage location restrictions to prevent uploaded files from being executed
File content inspection to detect malicious payloads

Without these controls, the application accepts and stores files of any type, including server-side scripts that can be executed when accessed via a web request.

Attack Vector

The attack is conducted remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a vulnerable QloApps installation with the hotel review feature accessible
Crafting a malicious file (typically a PHP web shell) disguised or uploaded directly
Submitting the malicious file through the hotel review upload functionality
Accessing the uploaded file via its URL to trigger code execution
Executing arbitrary commands on the server through the web shell

Technical details and proof-of-concept information can be found in the GitHub CVE-2025-67325 Exploit repository.

Detection Methods for CVE-2025-67325

Indicators of Compromise

Presence of unexpected PHP files or web shells in upload directories associated with hotel reviews
Web server logs showing POST requests to review upload endpoints followed by GET requests to unusual file paths
Files with double extensions (e.g., .php.jpg, .phtml) in upload directories
Unexpected outbound connections or reverse shell activity originating from the web server process

Detection Strategies

Monitor file system changes in QloApps upload directories for newly created executable files
Implement web application firewall (WAF) rules to detect and block file upload attempts containing PHP code or other scripting languages
Review web server access logs for suspicious patterns indicating file upload exploitation attempts
Deploy file integrity monitoring (FIM) on web application directories to alert on unauthorized file creation

Monitoring Recommendations

Enable verbose logging on the QloApps application and web server to capture all upload activity
Implement real-time alerting for file creation events in upload directories with executable file extensions
Monitor for anomalous process spawning from web server processes (e.g., www-data or apache spawning shell processes)
Regularly scan upload directories for files that do not match expected content types

How to Mitigate CVE-2025-67325

Immediate Actions Required

Upgrade QloApps to the latest version that addresses this vulnerability
If immediate upgrade is not possible, disable or restrict access to the hotel review feature temporarily
Audit existing upload directories for any suspicious or unexpected files and remove them
Implement network-level access controls to limit exposure of the QloApps application

Patch Information

Organizations running QloApps version 1.7.0 or earlier should update to the latest patched version available from the official QloApps GitHub repository. Review the changelog and security advisories for specific patch information addressing this unrestricted file upload vulnerability.

Workarounds

Configure the web server to prevent execution of scripts in upload directories by removing execute permissions or adding .htaccess rules that deny script execution
Implement server-side file type validation that checks both file extensions and MIME types against an allowlist of safe types
Store uploaded files outside the web root or in a location where direct access is blocked
Deploy a Web Application Firewall (WAF) with rules to inspect and block malicious file uploads

bash

# Apache .htaccess configuration to prevent script execution in upload directories
# Place this file in the QloApps upload directory
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|aspx|cgi|sh)$">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP engine entirely for the directory
php_flag engine off