Skip to content

Instantly share code, notes, and snippets.

@CongSec

CongSec/（CVE-2025-65474）Exploiting CSRF Vulnerability to Achieve RCE.md

Created December 5, 2025 06:35
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save CongSec/3cf968621f71a7da35dcc9b8f0b29bb2 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save CongSec/3cf968621f71a7da35dcc9b8f0b29bb2 to your computer and use it in GitHub Desktop.
Download ZIP
（CVE-2025-65474）Exploiting CSRF Vulnerability to Achieve RCE
Raw
（CVE-2025-65474）Exploiting CSRF Vulnerability to Achieve RCE.md

CVE ID

CVE-2025-65474

Vulnerable Version(PRODUCT)

icret/EasyImages2.0/2.8.6 before

PROBLEM TYPE

Remote

DESCRIPTION

An attacker first embeds a PHP web shell into a normal image, renames it to an SVG file to bypass upload compression, uploads it to the EasyImages2.0 system, then constructs a malicious admin/manager.php URL (with p for the file directory, ren for the SVG filename, and to for a PHP filename) to trick an administrator into clicking "this renames the SVG to a PHP file, enabling the attacker to use tools like AntSword for remote code execution.

Vulnerability URL/Address

github：https://github.com/icret/EasyImages2.0

target：http://xxx.com/admin/manager.php?p=xxx&ren=xxx&xxx

Environment Setup

直接使用docker run -itd --name easyimage -p 8777:80 -e TZ=Asia/Shanghai -e PUID=1000 -e PGID=1000 -e DEBUG=false -v /root/data/docker_data/easyimage/config:/app/web/config -v /root/data/docker_data/easyimage/i:/app/web/i ddsderek/easyimage:latest命令启动环境

Verification Process

  1. Start with a normal image, open it with a text editor, and append a web shell script at the end

    1. image

  2. Rename the file extension from .png​ to .svg to avoid damage from image compression during upload. Upload the modified file to the image hosting service

    1. image

  3. We obtained the address http://x.x.x.x:8777/i/2025/11/04/z2b9th.svg​ and constructed the payload as:
    ​http://x.x.x.x:8777/admin/manager.php?p=2025%2F11%2F04&ren=z2b9th.svg&to=congsec.php

    Where:

    • ​p represents the image directory
    • ​ren is the original image name
    • ​to is the modified filename

    The exploit works by tricking an administrator into clicking the link, which rewrites the malicious SVG file into a PHP web shell, enabling server-side execution.

  4. When the administrator clicks the link, the file is renamed to congsec.php

    1. image

  5. Use a tool like AntSword to connect to the web shell at http://x.x.x.x:8777/i/2025/11/04/congsec.php and execute arbitrary commands

    1. image
    2. image
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment