Add vpatch-CVE-2025-47188 rule and test (#1619)

* Add vpatch-CVE-2025-47188 rule

* Add vpatch-CVE-2025-47188 test config

* Add CVE-2025-47188.yaml test

* Add vpatch-CVE-2025-47188 rule to vpatch collection

* fix nuclei template

* ci

---------

Co-authored-by: Thibault Koechlin <orixxx@gmail.com>
Co-authored-by: Thibault "bui" Koechlin <thibault@crowdsec.net>

Author: crowdsec-automation

.appsec-tests/vpatch-CVE-2025-47188/CVE-2025-47188.yaml

@@ -0,0 +1,26 @@
+## autogenerated on 2025-12-29 14:06:31
+id: CVE-2025-47188
+info:
+  name: CVE-2025-47188
+  author: crowdsec
+  severity: info
+  description: CVE-2025-47188 testing
+  tags: appsec-testing
+http:
+  - raw:
+      - |
+        POST /cgi-bin/webconfig?page=upload_ringtone&action=submit&section=1&conn=0 HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----0ba2fc3a8c91370bd74c5f7ab65fda3f
+
+        ------0ba2fc3a8c91370bd74c5f7ab65fda3f
+        Content-Disposition: form-data; name="upload_ringtone/newfile"; filename="fake$(sh ${HOME}userdata${HOME}ringtone${HOME}877123.txt).wav"
+
+        This is an invalid WAV file
+        ------0ba2fc3a8c91370bd74c5f7ab65fda3f--
+
+    cookie-reuse: true
+    matchers:
+    - type: status
+      status:
+       - 403

.appsec-tests/vpatch-CVE-2025-47188/config.yaml

@@ -0,0 +1,5 @@
+## autogenerated on 2025-12-29 14:06:31
+appsec-rules:
+  - ./appsec-rules/crowdsecurity/base-config.yaml
+  - ./appsec-rules/crowdsecurity/vpatch-CVE-2025-47188.yaml
+nuclei_template: CVE-2025-47188.yaml

appsec-rules/crowdsecurity/vpatch-CVE-2025-47188.yaml

@@ -0,0 +1,40 @@
+## autogenerated on 2025-12-29 14:06:31
+name: crowdsecurity/vpatch-CVE-2025-47188
+description: 'Detects OS command injection in Mitel 6000 series SIP Phones via ringtone upload functionality.'
+rules:
+  - and:
+      - zones:
+          - URI
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: /cgi-bin/webconfig
+      - zones:
+          - ARGS
+        variables:
+          - page
+        transform:
+          - lowercase
+        match:
+          type: equals
+          value: upload_ringtone
+      - zones:
+          - FILENAMES
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: '$('
+
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: 'http:exploit'
+  label: 'Mitel 6000 - RCE'
+  classification:
+    - cve.CVE-2025-47188
+    - attack.T1190
+    - cwe.CWE-78

collections/crowdsecurity/appsec-virtual-patching.yaml

@@ -146,6 +146,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2025-9316
 - crowdsecurity/vpatch-CVE-2025-11700
 - crowdsecurity/vpatch-CVE-2025-13315
+- crowdsecurity/vpatch-CVE-2025-47188
 author: crowdsecurity
 contexts:
 - crowdsecurity/appsec_base