Arbitrary Code Execution Vulnerability in Badaso CMS by Uasoft Indonesia

CVE-2025-52353

What is CVE-2025-52353?

An arbitrary code execution vulnerability has been identified in Badaso CMS version 2.9.11, allowing attackers to exploit the Media Manager feature. Authenticated users can upload files containing malicious PHP code through the file-upload endpoint, effectively bypassing content-type validations. When these files are accessed via their respective URLs, the server erroneously executes the embedded code, granting attackers the ability to run arbitrary commands on the server. A notable exploitation method involves embedding a backdoor within a seemingly harmless PDF file, renamed with a .php extension, demonstrating the critical implications of this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References