CVE-2025-58048 IBM QRadar · QRadar

Detect CVE-2025-58048: Paymenter Remote Code Execution via Unrestricted File Upload in IBM QRadar

Detects exploitation of CVE-2025-58048, a critical unrestricted file upload vulnerability (CWE-434) in Paymenter versions prior to 1.2.11. Attackers can upload malicious files (e.g., PHP webshells) through publicly accessible upload endpoints, achieving remote code execution on the server. CVSS 9.9 with public PoC available.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Impact

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  QIDNAME(qid) as event_name,
  CATEGORYNAME(category) as category_name,
  'CVE-2025-58048' as cve_reference
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'nginx', 'Microsoft IIS')
  AND (LOWER(URL) LIKE '%/upload%' OR LOWER(URL) LIKE '%/files%' OR LOWER(URL) LIKE '%/storage/app/public%')
  AND (LOWER(URL) LIKE '%.php' OR LOWER(URL) LIKE '%.phtml' OR LOWER(URL) LIKE '%.phar'
       OR LOWER(URL) LIKE '%.asp' OR LOWER(URL) LIKE '%.aspx' OR LOWER(URL) LIKE '%.jsp'
       OR LOWER(URL) LIKE '%.sh' OR LOWER(URL) LIKE '%.bash' OR LOWER(URL) LIKE '%.py')
  AND HTTP_METHOD = 'POST'
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000
critical severity medium confidence

QRadar AQL query detecting POST requests to Paymenter upload paths that result in executable file extensions being uploaded, consistent with CVE-2025-58048 exploitation attempts.

Data Sources

QRadar SIEMWeb Server Log SourcesNetwork IDS/IPS

Required Tables

events

False Positives & Tuning

  • Legitimate software update mechanisms that upload PHP component files
  • Authorized developer deployments pushing PHP code through web interfaces
  • Content delivery pipelines that route PHP files through upload directories
  • Security scanning tools that test file upload endpoints with benign payloads

Other platforms for CVE-2025-58048

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Upload PHP Webshell to Paymenter Public Storage

    Expected signal: Web server logs showing POST to /upload with multipart/form-data containing .php file; file creation event in storage/app/public directory; HTTP 200/201 response code

  2. Test 2Execute Commands via Uploaded Webshell

    Expected signal: GET requests to storage/app/public/*.php path; PHP process spawning id, uname, whoami child processes; outbound network connection from PHP/web server process to attacker IP

  3. Test 3Bypass MIME Type Restriction via Content-Type Spoofing

    Expected signal: Web server logs showing POST uploads with mismatched Content-Type and file extension; file creation events with double extensions or PHP extensions in upload directories; magic byte mismatch in uploaded files

Last updated: 2026-06-23 Research depth: standard
References (5)

Unlock Pro Content

Get the full detection package for CVE-2025-58048 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.004Unix ShellT1083File and Directory Discovery

Same Tactic: Initial Access

Popular Detections