DobryCMS SQL injection and remote code execution flaws
Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute SQL injection and achieve remote code execution via unrestricted file upload.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of two significant vulnerabilities affecting DobryCMS, a content management system. The first vulnerability, CVE-2025-12462, is a blind SQL injection flaw that permits remote unauthenticated attackers to inject malicious SQL syntax through URL path parameters. This could allow attackers to extract sensitive database information or manipulate backend data without authentication.
The second vulnerability, CVE-2025-14532, is an unrestricted file upload flaw in DobryCMS's upload functionality. This vulnerability enables unauthenticated remote attackers to upload files of any type or extension without restriction, creating a direct path to remote code execution on affected systems. Both vulnerabilities pose serious risks to DobryCMS installations due to the lack of authentication requirements.
The vendor has released patches addressing these issues. CVE-2025-12462 was fixed in versions above 8.0, while CVE-2025-14532 was remediated in versions above 5.0. Organizations running DobryCMS should upgrade immediately to the latest patched versions to mitigate these risks.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Interpreter (Possible Web Shell Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or CMS backend process spawning a shell or scripting interpreter, consistent with web shell execution following exploitation of an unrestricted file upload vulnerability (e.g., DobryCMS CVE-2025-14532). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Interpreter
id: 38802cd1-8b5a-5d43-842c-340245e08916
status: experimental
description: Detects a web server or CMS application process (IIS, Apache, Nginx,
PHP-FPM) spawning a command or scripting interpreter, a common indicator of web
shell execution after exploitation of an unrestricted file upload vulnerability
such as CVE-2025-14532 in DobryCMS.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
SQL/upload files
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\w3wp.exe
- \\httpd.exe
- \\nginx.exe
- \\php-cgi.exe
- \\php.exe
- \\tomcat.exe
- \\java.exe
selection_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\bash.exe
- \\sh.exe
filter_admin:
CommandLine|contains:
- IISReset
- w3wp -ap
condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate server-side scripts or admin tooling that intentionally shell out from
the web application process for maintenance tasks
- Monitoring or health-check scripts executed by the web server on a schedule
level: high
Script File Written to Web-Accessible Upload Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of executable script files (php, jsp, asp, aspx) within web application upload or content directories, indicative of a web shell dropped via an unrestricted file upload vulnerability like CVE-2025-14532. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Written to Web-Accessible Upload Directory
id: 0e5cab98-b446-50ff-ba01-a75cc1649b25
status: experimental
description: Detects the creation of script files with server-executable extensions
(php, jsp, asp, aspx) within directories commonly used for CMS uploads, consistent
with exploitation of an unrestricted file upload vulnerability such as CVE-2025-14532
in DobryCMS to drop a web shell.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
SQL/upload files
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- \\uploads\\
- \\upload\\
- \\media\\
- \\files\\
- \\wwwroot\\
selection_ext:
TargetFilename|endswith:
- .php
- .php5
- .phtml
- .jsp
- .jspx
- .asp
- .aspx
filter_deploy:
Image|endswith:
- \\msiexec.exe
- \\devenv.exe
condition: selection_path and selection_ext and not filter_deploy
falsepositives:
- Legitimate developer deployment of new site scripts to upload directories via CI/CD
pipelines
- Content management workflows that intentionally allow script uploads for approved
plugins/themes
level: high
Suspicious Outbound Connection from Web Server Process (Possible Web Shell C2)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or application process initiating outbound network connections shortly after handling upload/URL requests, which may indicate a web shell established via exploitation of DobryCMS vulnerabilities communicating with an attacker. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Initiating Outbound Network Connection
id: 241d7280-2163-53e9-b294-16ceeb7afea9
status: experimental
description: Detects a web server or CMS application binary establishing outbound
network connections, a behavior inconsistent with normal web server operation and
potentially indicative of a web shell used post-exploitation of an unauthenticated
upload or SQL injection vulnerability (e.g., DobryCMS CVE-2025-12462 / CVE-2025-14532)
reaching out to an attacker-controlled host.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
SQL/upload files
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \\w3wp.exe
- \\httpd.exe
- \\nginx.exe
- \\php-cgi.exe
- \\php.exe
- \\tomcat.exe
filter_internal:
DestinationIp|startswith:
- '10.'
- 192.168.
- 172.16.
condition: selection and not filter_internal
falsepositives:
- Web application legitimately calling external APIs, license servers, or update services
- Monitoring agents attached to the web server process that generate outbound telemetry
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-12462
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs