Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute SQL…

2 March 2026 critical vulnerability

Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute SQL injection and achieve remote code execution via unrestricted file upload.

CERT Polska coordinated the disclosure of two significant vulnerabilities affecting DobryCMS, a content management system. The first vulnerability, CVE-2025-12462, is a blind SQL injection flaw that permits remote unauthenticated attackers to inject malicious SQL syntax through URL path parameters. This could allow attackers to extract sensitive database information or manipulate backend data without authentication.

The second vulnerability, CVE-2025-14532, is an unrestricted file upload flaw in DobryCMS's upload functionality. This vulnerability enables unauthenticated remote attackers to upload files of any type or extension without restriction, creating a direct path to remote code execution on affected systems. Both vulnerabilities pose serious risks to DobryCMS installations due to the lack of authentication requirements.

The vendor has released patches addressing these issues. CVE-2025-12462 was fixed in versions above 8.0, while CVE-2025-14532 was remediated in versions above 5.0. Organizations running DobryCMS should upgrade immediately to the latest patched versions to mitigate these risks.

Mentioned in this report

Vulnerabilities CVE-2025-12462CVE-2025-14532

Detection guidance

Web Server Process Spawning Command Interpreter (Possible Web Shell Execution)

ATT&CK T1505.003

Detects a web server or CMS backend process spawning a shell or scripting interpreter, consistent with web shell execution following exploitation of an unrestricted file upload vulnerability (e.g., DobryCMS CVE-2025-14532). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Interpreter
id: 38802cd1-8b5a-5d43-842c-340245e08916
status: experimental
description: Detects a web server or CMS application process (IIS, Apache, Nginx,
  PHP-FPM) spawning a command or scripting interpreter, a common indicator of web
  shell execution after exploitation of an unrestricted file upload vulnerability
  such as CVE-2025-14532 in DobryCMS.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
  SQL/upload files
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    - \\tomcat.exe
    - \\java.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\bash.exe
    - \\sh.exe
  filter_admin:
    CommandLine|contains:
    - IISReset
    - w3wp -ap
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate server-side scripts or admin tooling that intentionally shell out from
  the web application process for maintenance tasks
- Monitoring or health-check scripts executed by the web server on a schedule
level: high

Script File Written to Web-Accessible Upload Directory

ATT&CK T1505.003

Detects creation of executable script files (php, jsp, asp, aspx) within web application upload or content directories, indicative of a web shell dropped via an unrestricted file upload vulnerability like CVE-2025-14532. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Written to Web-Accessible Upload Directory
id: 0e5cab98-b446-50ff-ba01-a75cc1649b25
status: experimental
description: Detects the creation of script files with server-executable extensions
  (php, jsp, asp, aspx) within directories commonly used for CMS uploads, consistent
  with exploitation of an unrestricted file upload vulnerability such as CVE-2025-14532
  in DobryCMS to drop a web shell.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
  SQL/upload files
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \\uploads\\
    - \\upload\\
    - \\media\\
    - \\files\\
    - \\wwwroot\\
  selection_ext:
    TargetFilename|endswith:
    - .php
    - .php5
    - .phtml
    - .jsp
    - .jspx
    - .asp
    - .aspx
  filter_deploy:
    Image|endswith:
    - \\msiexec.exe
    - \\devenv.exe
  condition: selection_path and selection_ext and not filter_deploy
falsepositives:
- Legitimate developer deployment of new site scripts to upload directories via CI/CD
  pipelines
- Content management workflows that intentionally allow script uploads for approved
  plugins/themes
level: high

Suspicious Outbound Connection from Web Server Process (Possible Web Shell C2)

ATT&CK T1190

Detects a web server or application process initiating outbound network connections shortly after handling upload/URL requests, which may indicate a web shell established via exploitation of DobryCMS vulnerabilities communicating with an attacker. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Initiating Outbound Network Connection
id: 241d7280-2163-53e9-b294-16ceeb7afea9
status: experimental
description: Detects a web server or CMS application binary establishing outbound
  network connections, a behavior inconsistent with normal web server operation and
  potentially indicative of a web shell used post-exploitation of an unauthenticated
  upload or SQL injection vulnerability (e.g., DobryCMS CVE-2025-12462 / CVE-2025-14532)
  reaching out to an attacker-controlled host.
references:
- Two critical vulnerabilities in DobryCMS allow unauthenticated attackers to execute
  SQL/upload files
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    - \\tomcat.exe
  filter_internal:
    DestinationIp|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection and not filter_internal
falsepositives:
- Web application legitimately calling external APIs, license servers, or update services
- Monitoring agents attached to the web server process that generate outbound telemetry
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-12462

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free