CERT Polska disclosed 9 vulnerabilities in end-of-life PAD CMS software, including…
CERT Polska disclosed 9 vulnerabilities in end-of-life PAD CMS software, including critical unauthenticated RCE flaws via unrestricted file upload with no patches available.
CERT Polska coordinated the disclosure of nine vulnerabilities affecting PAD CMS, a content management system that has reached end-of-life status and will not receive security patches. The most severe vulnerabilities (CVE-2025-7063, CVE-2025-7065, CVE-2025-8120) allow unauthenticated remote attackers to achieve Remote Code Execution through unrestricted file upload functionality due to client-controlled permission checks. These flaws enable attackers to upload and execute arbitrary files without authentication.
Additional vulnerabilities discovered during CERT Polska's research include Reflected XSS in print/PDF functionality (CVE-2025-8116), improper password recovery initialization allowing account takeover (CVE-2025-8117), client-side brute-force protection bypass (CVE-2025-8118), CSRF in password reset (CVE-2025-8119), and Blind SQL Injection in article positioning (CVE-2025-8121, CVE-2025-8122). These issues affect all three PAD CMS templates: www, bip, and www+bip.
Given the end-of-life status and absence of available patches, organizations running PAD CMS face significant risk and should immediately migrate to alternative platforms. The combination of unauthenticated RCE and multiple authentication bypass mechanisms makes this software critically insecure for continued use.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible Webshell Execution)
Detects a web server or PHP process spawning a command interpreter, consistent with post-exploitation webshell execution following unrestricted file upload RCE in PAD CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\php-cgi.exe
- \\php.exe
- \\httpd.exe
- \\apache.exe
- \\nginx.exe
- \\w3wp.exe
selection_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\cscript.exe
- \\wscript.exe
- \\bash.exe
- \\sh.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI or server-side scripts that intentionally invoke system utilities
as part of normal application functionality
- Administrative scripts triggered through a web management console
level: high
tags:
- attack.t1505.003
- attack.t1190
id: 31db7801-5a1e-56e1-9408-2a440a89e7b6
status: experimental
author: Vorant
Script File Written to Web Upload Directory (Unrestricted File Upload)
Detects creation of executable script files (php/jsp/asp/aspx) in commonly writable web upload or image directories, indicative of exploitation of unrestricted file upload vulnerabilities such as those in PAD CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Dropped in Web Upload Directory
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \\uploads\\
- \\images\\
- \\media\\
- \\files\\
TargetFilename|endswith:
- .php
- .phtml
- .jsp
- .asp
- .aspx
filter:
TargetFilename|contains:
- \\vendor\\
- \\node_modules\\
condition: selection and not filter
falsepositives:
- Legitimate CMS plugin or template installation that writes script files into media
directories
- Developer deployment of application code directly into upload folders
level: medium
tags:
- attack.t1190
- attack.t1505.003
id: 3aab120c-57cb-55b1-8195-d94b719d3802
status: experimental
author: Vorant
Command Execution Following Web Process with Suspicious Web Shell Command Patterns
Detects command-line execution launched by web server processes containing typical webshell reconnaissance or system commands, suggesting successful exploitation of an unauthenticated RCE (e.g. via unrestricted file upload) and subsequent interactive command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Command Execution From Web Server Context
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\php-cgi.exe
- \\php.exe
- \\httpd.exe
- \\nginx.exe
- \\w3wp.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- systeminfo
- ipconfig
- tasklist
- certutil
- 'curl '
- 'wget '
condition: selection_parent and selection_cmd
falsepositives:
- Legitimate diagnostic scripts triggered by administrators through a web-based management
interface
level: high
tags:
- attack.t1059
- attack.t1190
- attack.t1203
id: 1f99e9ea-9221-5145-a321-acbff9bcc0f2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-7063
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free