Skip to content

Commit 0d197c8

Browse files
buixorbuixor
authored
add CVEs CVE-2025-4689 CVE-2025-61678 CVE-2025-66039 (#1707)
1 parent 5af57cf commit 0d197c8

File tree

10 files changed

+175
-0
lines changed

10 files changed

+175
-0
lines changed

‎.appsec-tests/vpatch-CVE-2025-4689/CVE-2025-4689.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: CVE-2025-4689
2+
info:
3+
name: CVE-2025-4689
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2025-4689 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
GET /wp-admin/admin-ajax.php?action=bsa_pro_get_ads&a_id=1'%20OR%201%3D1-- HTTP/1.1
12+
Host: {{Hostname}}
13+
cookie-reuse: true
14+
matchers:
15+
- type: status
16+
status:
17+
- 403

‎.appsec-tests/vpatch-CVE-2025-4689/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2025-4689.yaml
4+
nuclei_template: CVE-2025-4689.yaml

‎.appsec-tests/vpatch-CVE-2025-61678/CVE-2025-61678.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: CVE-2025-61678
2+
info:
3+
name: CVE-2025-61678
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2025-61678 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
GET /admin/config.php?display=firmware&fwbrand=../../var/www/html/shell&upload_cust_fw=1 HTTP/1.1
12+
Host: {{Hostname}}
13+
cookie-reuse: true
14+
matchers:
15+
- type: status
16+
status:
17+
- 403

‎.appsec-tests/vpatch-CVE-2025-61678/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2025-61678.yaml
4+
nuclei_template: CVE-2025-61678.yaml

‎.appsec-tests/vpatch-CVE-2025-66039/CVE-2025-66039.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: CVE-2025-66039
2+
info:
3+
name: CVE-2025-66039
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2025-66039 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
GET /admin/config.php?display=basestation&id=1'%20OR%201%3D1-- HTTP/1.1
12+
Host: {{Hostname}}
13+
cookie-reuse: true
14+
matchers:
15+
- type: status
16+
status:
17+
- 403

‎.appsec-tests/vpatch-CVE-2025-66039/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2025-66039.yaml
4+
nuclei_template: CVE-2025-66039.yaml

‎appsec-rules/crowdsecurity/vpatch-CVE-2025-4689.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: crowdsecurity/vpatch-CVE-2025-4689
2+
description: 'Detects WordPress Ads Pro Plugin unauthenticated SQLi + LFI chain via wp-ajax endpoint targeting a_id parameter (CVE-2025-4689)'
3+
rules:
4+
- and:
5+
- zones:
6+
- URI
7+
transform:
8+
- lowercase
9+
- urldecode
10+
match:
11+
type: contains
12+
value: '/wp-admin/admin-ajax.php'
13+
- zones:
14+
- ARGS
15+
variables:
16+
- action
17+
transform:
18+
- lowercase
19+
- urldecode
20+
match:
21+
type: contains
22+
value: 'bsa_pro'
23+
- zones:
24+
- ARGS
25+
variables:
26+
- a_id
27+
transform:
28+
- lowercase
29+
- urldecode
30+
match:
31+
type: regex
32+
value: "[^0-9]"
33+
labels:
34+
type: exploit
35+
service: http
36+
confidence: 3
37+
spoofable: 0
38+
behavior: 'http:exploit'
39+
label: 'WordPress Ads Pro Plugin - SQLI'
40+
classification:
41+
- cve.CVE-2025-4689
42+
- attack.T1190
43+
- cwe.CWE-89

‎appsec-rules/crowdsecurity/vpatch-CVE-2025-61678.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: crowdsecurity/vpatch-CVE-2025-61678
2+
description: 'Detects FreePBX arbitrary file upload RCE via fwbrand directory traversal in Custom Firmware Management endpoint (CVE-2025-61678)'
3+
rules:
4+
- and:
5+
- zones:
6+
- URI
7+
transform:
8+
- lowercase
9+
- urldecode
10+
match:
11+
type: contains
12+
value: '/admin/config.php'
13+
- zones:
14+
- ARGS
15+
variables:
16+
- fwbrand
17+
transform:
18+
- lowercase
19+
- urldecode
20+
match:
21+
type: contains
22+
value: '..'
23+
labels:
24+
type: exploit
25+
service: http
26+
confidence: 3
27+
spoofable: 0
28+
behavior: 'http:exploit'
29+
label: 'FreePBX - RCE'
30+
classification:
31+
- cve.CVE-2025-61678
32+
- attack.T1190
33+
- cwe.CWE-22

‎appsec-rules/crowdsecurity/vpatch-CVE-2025-66039.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: crowdsecurity/vpatch-CVE-2025-66039
2+
description: 'Detects FreePBX authentication bypass and SQL injection chain via admin config endpoint (CVE-2025-66039, CVE-2025-61675)'
3+
rules:
4+
- and:
5+
- zones:
6+
- URI
7+
transform:
8+
- lowercase
9+
- urldecode
10+
match:
11+
type: contains
12+
value: '/admin/config.php'
13+
- zones:
14+
- ARGS
15+
variables:
16+
- id
17+
transform:
18+
- lowercase
19+
- urldecode
20+
match:
21+
type: regex
22+
value: "[^0-9]"
23+
labels:
24+
type: exploit
25+
service: http
26+
confidence: 3
27+
spoofable: 0
28+
behavior: 'http:exploit'
29+
label: 'FreePBX - Authentication Bypass SQLI'
30+
classification:
31+
- cve.CVE-2025-66039
32+
- attack.T1190
33+
- cwe.CWE-89

‎collections/crowdsecurity/appsec-virtual-patching.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,9 @@ appsec-rules:
165165
- crowdsecurity/vpatch-CVE-2026-1207
166166
- crowdsecurity/vpatch-WT-2026-0001
167167
- crowdsecurity/vpatch-CVE-2026-1281
168+
- crowdsecurity/vpatch-CVE-2025-66039
169+
- crowdsecurity/vpatch-CVE-2025-61678
170+
- crowdsecurity/vpatch-CVE-2025-4689
168171
author: crowdsecurity
169172
contexts:
170173
- crowdsecurity/appsec_base

0 commit comments

Comments
 (0)