Arbitrary Code Execution Vulnerability in Badaso CMS by Uasoft Indonesia

CVE-2025-52353

What is CVE-2025-52353?

An arbitrary code execution vulnerability has been identified in Badaso CMS version 2.9.11, allowing attackers to exploit the Media Manager feature. Authenticated users can upload files containing malicious PHP code through the file-upload endpoint, effectively bypassing content-type validations. When these files are accessed via their respective URLs, the server erroneously executes the embedded code, granting attackers the ability to run arbitrary commands on the server. A notable exploitation method involves embedding a backdoor within a seemingly harmless PDF file, renamed with a .php extension, demonstrating the critical implications of this vulnerability.

References