CVE-2025-52353

The vulnerability resides in the Media Manager component of Badaso CMS 2.9.11, where the file upload endpoint fails to properly validate content types. This allows authenticated users to upload files containing embedded PHP code, for example by embedding a backdoor within a PDF and renaming it with a .php extension [1].

Exploitation requires an authenticated user with access to the Media Manager. The attacker uploads a file with a .php extension that contains PHP code. When the file is accessed via its URL, the server executes the PHP payload because the application does not prevent execution of user-uploaded PHP files [1].

Successful exploitation enables an attacker to run arbitrary system commands, leading to full compromise of the underlying host. The attacker can execute commands, read or modify files, and potentially pivot to other systems [1].

As of publication, no official patch has been released. Users should implement strict file type validation and consider disabling PHP execution in upload directories. The vendor's GitHub repository provides the source code for potential mitigation [2].