CVE-2025-8128: Zhousg Letao RCE Vulnerability

CVE-2025-8128 Overview

CVE-2025-8128 is an unrestricted file upload vulnerability in the zhousg letao e-commerce application. The flaw resides in the routes\bf\product.js file, where improper handling of the pictrdtz argument allows an authenticated remote attacker to upload arbitrary files. The project follows a rolling-release model, so no fixed version identifiers are available beyond the commit reference 7d8df0386a65228476290949e0413de48f7fbe98. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The weakness is tracked under CWE-284 Improper Access Control.

Critical Impact

Remote attackers with low-privilege credentials can upload unrestricted files to the server through the backend product management endpoint, enabling potential webshell deployment or malicious content delivery.

Affected Products

• zhousg letao (rolling release up to commit 7d8df0386a65228476290949e0413de48f7fbe98)
• Backend route handler routes\bf\product.js
• Deployments exposing the backend product upload interface over the network

Discovery Timeline

• 2025-07-25 - CVE-2025-8128 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8128

Vulnerability Analysis

The vulnerability affects the backend product management route in the letao application. The pictrdtz parameter, used during product picture handling in routes\bf\product.js, accepts uploads without enforcing restrictions on file type, extension, or content. An authenticated attacker can submit a crafted request to the vulnerable endpoint and place arbitrary files onto the server filesystem.

Because the project is distributed as a rolling release through GitHub, there are no numbered versions and no formal patch release. Operators who deploy letao from source are responsible for applying mitigations manually.

Root Cause

The root cause is improper access control combined with missing input validation on the pictrdtz upload argument. The handler does not validate the uploaded file's MIME type, extension, or magic bytes before writing it to disk. This matches the [CWE-284] classification for improper access control over an upload operation.

Attack Vector

The attack is remote and requires low-level privileges on the backend interface. An attacker submits a POST request to the product management route, supplying a malicious file through the pictrdtz parameter. Because no server-side filtering is applied, the file is accepted and stored in a web-accessible location, where it may later be requested to trigger execution or serve malicious content. Public disclosure through GitHub Issue #13 and VulDB entry 317513 lowers the barrier to reproduction.

No verified proof-of-concept code is published in a sanitized form. Refer to the external references for technical reproduction details.

Detection Methods for CVE-2025-8128

Indicators of Compromise

• Unexpected files with executable extensions (.js, .php, .jsp, .html) appearing in the letao product image upload directory
• HTTP POST requests to the backend product route containing the pictrdtz parameter with non-image payloads
• Outbound connections initiated by the Node.js process after an upload event
• New or modified files in web-accessible directories without a corresponding administrative action in application logs

Detection Strategies

• Inspect reverse proxy and application logs for POST requests to /bf/product style endpoints that reference pictrdtz with unusual Content-Type values
• Correlate authentication events with upload activity to identify low-privilege accounts performing bulk or atypical uploads
• Baseline the upload directory and alert on any file whose extension or magic bytes do not match an image format

Monitoring Recommendations

• Enable file integrity monitoring on all letao upload directories
• Forward Node.js application logs and web server access logs to a centralized analytics platform for retention and query
• Monitor process creation on the host for child processes spawned by the Node.js runtime after upload activity

How to Mitigate CVE-2025-8128

Immediate Actions Required

• Restrict network access to the letao backend management interface to trusted administrative networks only
• Audit existing files in the product upload directory and remove any file that is not a legitimate image
• Rotate credentials for all backend accounts, since exploitation requires only low-level privileges
• Review application and web server logs for prior exploitation attempts referencing the pictrdtz parameter

Patch Information

The project maintainer distributes letao through rolling GitHub commits, and no formal patched release is referenced in the advisory. Track the upstream repository and the discussion in GitHub Issue #13 for remediation guidance. Operators should apply source-level fixes that validate file extensions, enforce MIME type checks, and store uploads outside of executable web paths.

Workarounds

• Place a reverse proxy rule in front of the application that rejects uploads whose declared Content-Type is not an allowed image format
• Configure the web server to deny script execution within the upload directory (for example, by serving it as static content only)
• Add server-side validation in routes\bf\product.js that enforces an allowlist of extensions and verifies file magic bytes before persisting
• Require strong authentication and multi-factor authentication for all backend accounts to limit the pool of attackers that can reach the vulnerable endpoint

# Example nginx configuration to prevent script execution in the uploads directory
location /uploads/ {
    types { }
    default_type application/octet-stream;
    add_header X-Content-Type-Options nosniff;
    location ~ \.(js|php|jsp|cgi|sh|html)$ {
        deny all;
    }
}