# DobryCMS SQLi and RCE flaws patched

Published: 2026-03-02 · Severity: high
Canonical: https://vorant.io/reports/eeb58c24-d960-5f45-8322-a11397c8ffc0/dobrycms-sqli-and-rce-flaws-patched

> Two critical vulnerabilities in DobryCMS—unauthenticated blind SQL injection (CVE-2025-12462) and unrestricted file upload enabling RCE (CVE-2025-14532)—have been fixed.

CERT Polska has coordinated the disclosure of two vulnerabilities in DobryCMS, a content management system. CVE-2025-12462 is a blind SQL injection flaw affecting versions prior to 8.0 that allows remote unauthenticated attackers to inject SQL syntax into multiple URL path parameters. CVE-2025-14532 is an unrestricted file upload vulnerability in versions prior to 5.0 that permits unauthenticated attackers to upload arbitrary files, leading to remote code execution.

Both vulnerabilities require no authentication and can be exploited remotely, presenting significant risk to unpatched DobryCMS installations. The issues were responsibly disclosed by multiple researchers and have been remediated in current versions. Organizations running DobryCMS should verify they are on version 8.0 or higher to address both flaws.

CERT Polska participated in coordinating the disclosure process, working with the researchers and vendor to ensure patches were available before public disclosure. No active exploitation has been reported in the advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2025-12462, CVE-2025-14532

## Detection guidance (public sample)

### Web Server Process Spawning Command Interpreter (Possible CMS RCE)

ATT&CK: T1059

Detects a web server or PHP process spawning a shell or scripting interpreter, consistent with post-exploitation of an unrestricted file upload RCE such as CVE-2025-14532 in DobryCMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Interpreter
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \tomcat8.exe
    - \tomcat9.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \net.exe
    - \whoami.exe
  filter:
    CommandLine|contains:
    - HealthCheck
    - monitoring
  condition: selection and not filter
falsepositives:
- Legitimate web application administration scripts that shell out to system utilities
- Monitoring or health-check agents integrated with the web server process
level: high
tags:
- attack.t1059
- attack.t1190
id: 6b41ff06-622f-5719-a51f-286212e66154
status: experimental
author: Vorant
```

### Web Application Writing Script File to Web-Accessible Directory

ATT&CK: T1190

Detects a web server or CMS process (e.g. IIS worker process, PHP, Apache/Tomcat) writing a new server-side script file, indicative of a webshell dropped via an unrestricted file upload vulnerability like CVE-2025-14532. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Process Writing Server-Side Script File
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \tomcat8.exe
    - \tomcat9.exe
    TargetFilename|endswith:
    - .php
    - .phtml
    - .asp
    - .aspx
    - .jsp
    - .jspx
  filter:
    TargetFilename|contains:
    - \vendor\
    - \node_modules\
  condition: selection and not filter
falsepositives:
- CMS or plugin updates that legitimately deploy new script files through the web
  server process
- Developer deployment pipelines writing application code directly from the web process
  account
level: medium
tags:
- attack.t1190
id: 3802f155-ef9e-55fd-9ce2-8632d5613030
status: experimental
author: Vorant
```

### Possible SQL Injection Payload in Web Request URL Path

ATT&CK: T1190

Detects common SQL injection syntax (UNION SELECT, SLEEP, boolean-based payloads) appearing in URL path parameters, matching the exploitation pattern used against blind SQLi flaws such as CVE-2025-12462 in DobryCMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Pattern in Web Request URL
logsource:
  category: proxy
  product: generic
detection:
  selection:
    c-uri|contains:
    - UNION SELECT
    - union select
    - SLEEP(
    - sleep(
    - ''' OR ''1''=''1'
    - 1=1--
    - benchmark(
    - xp_cmdshell
  condition: selection
falsepositives:
- Security scanning tools or vulnerability assessments testing the application intentionally
- Application penetration tests conducted by authorized internal teams
level: medium
tags:
- attack.t1190
id: a35efb9f-ec91-54f7-b612-2e065a62391c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-12462

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eeb58c24-d960-5f45-8322-a11397c8ffc0/dobrycms-sqli-and-rce-flaws-patched.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup