CVE-2025-58048: Critical Remote Code Execution in Paymenter via Unrestricted File Upload

Vulnerability Overview

CVE-2025-58048 is a critical unrestricted file upload vulnerability (CWE-434) in Paymenter, an open-source billing and client management panel commonly used by hosting providers. The root cause is insufficient validation of uploaded file types on publicly accessible upload endpoints — an unauthenticated or low-privileged attacker can upload arbitrary files, including PHP webshells, directly to the server. Once a malicious file lands in a web-accessible directory, the attacker achieves remote code execution (RCE) under the web server's process context. This vulnerability carries a CVSS score of 9.9, placing it at the top of the critical severity band.

Affected Software

• Vendor: Paymenter (distributed via Composer as paymenter/paymenter)
• Affected versions: All releases prior to 1.2.11
• Fixed version: 1.2.11 and later

Organizations running self-hosted Paymenter instances below version 1.2.11 are directly exposed. Hosting panels of this type often face the public internet and handle payment and customer data, making exploitation particularly damaging.

Exploitation Status

A public proof-of-concept (PoC) exploit is available for CVE-2025-58048. This materially lowers the bar for exploitation — opportunistic attackers and automated scanners can weaponize the PoC without deep technical knowledge. Although this CVE has not yet appeared on CISA's Known Exploited Vulnerabilities (KEV) catalog as of disclosure, the combination of a CVSS 9.9 score, public PoC, and internet-exposed attack surface means defenders should treat this as actively exploitable and prioritize patching or mitigation immediately.

How Our Detection Catches It

The df00tech detection pack for CVE-2025-58048 ships coverage across seven SIEM platforms. Each query targets the behavioral indicators most reliably produced during exploitation:

• Microsoft Sentinel (KQL) — Correlates web server access logs for POST requests to Paymenter upload endpoints resulting in 200 responses, followed by subsequent GET requests to files with executable extensions (.php, .phtml, etc.) in upload directories.
• Splunk (SPL) — Hunts for multipart form-data uploads to known Paymenter routes combined with process execution events (e.g., php-fpm or apache spawning unexpected child processes) consistent with webshell invocation.
• Elastic (EQL) — Uses sequence detection to chain file-write events into web-accessible paths with PHP extensions against subsequent network-bound process activity.
• QRadar (AQL) — Filters HTTP log sources for anomalous upload transactions and correlates with filesystem audit events for new executable file creation under web roots.
• Sumo Logic — Parses web access logs for upload indicators and flags low-prevalence executable file types appearing in Paymenter's storage paths.
• Chronicle (YARA-L) — Rule targets the upload event pattern combined with UDM file-creation events carrying high-risk MIME types or extensions in web-served directories.
• CrowdStrike (CQL) — Endpoint-side detection covering process tree anomalies where the web server spawns shells or interpreter processes consistent with webshell execution post-upload.

Collectively, the detection logic operates at both the network/HTTP layer (catching the upload itself) and the endpoint layer (catching post-exploitation webshell activity), providing defense-in-depth coverage even when one telemetry source is unavailable.

Recommended Actions

• Upgrade Paymenter to version 1.2.11 or later immediately.
• If immediate patching is not possible, restrict access to upload endpoints via WAF rules or network controls.
• Audit web-accessible directories for unexpected PHP or script files.
• Review web server process trees for anomalous child processes spawned by php, apache2, or nginx workers.

For full detection queries across all seven SIEM platforms, along with playbook guidance and atomic test cases, see the CVE-2025-58048 detection page.