CVE-2024-25832

published 2024-02-29

CVE-2024-25832: F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by…

Priority P2 70 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
f-logic	datacube3	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /admin/config_all.php↗

path /admin/setting_photo.php↗

filename rvs.php↗

path /images/slideshow/rvs.php↗

command user_id=root↗

• → Alert on GET requests to /images/slideshow/*.php — the exploit drops the PHP reverse shell into this directory and then triggers it via a direct HTTP GET. ↗
• → Detect unauthenticated GET requests to /admin/config_all.php that receive a non-302 response — the exploit uses this endpoint to leak admin and root credentials before authentication. ↗
• → Look for the specific multipart boundary string used by the PoC exploit in HTTP request bodies. ↗

• · The exploit is a chained attack combining CVE-2024-25830 (unauthenticated credential/root password leak via /admin/config_all.php) with CVE-2024-25832 (unrestricted file upload). Authentication is obtained programmatically using the leaked root password, so the file upload step appears authenticated. ↗
• · The uploaded PHP webshell is placed under /images/slideshow/ and served directly by the web server, meaning the web root must serve that directory. Detection should cover both the upload POST and the subsequent GET trigger. ↗
• · The exploit targets DataCube3 version 1.0 running on Ubuntu. The PoC hardcodes the login field value as a URL-encoded Japanese string ('%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3'), which can serve as an additional fingerprint in login POST traffic. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434