CVE-2025-15067: Critical Unauthenticated File Upload Flaw Enabling Web Shell Deployment and Full Server Takeover

Vulnerability Quick Reference

Field	Details
CVE ID	CVE-2025-15067
Vulnerability Name	Unrestricted Upload of File with Dangerous Type
Affected Product	Innorix WP (Web Platform / File Transfer Solution)
Affected Versions	All versions where the `exam` directory exists under the installation path
Vendor	Innorix
CWE	CWE-434 – Unrestricted Upload of File with Dangerous Type
CVSS v3.1 Score (Estimated)	9.8 – Critical
Severity	CRITICAL
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None (Unauthenticated)
User Interaction	None
Exploit Availability	Highly Likely
Primary Impact	Remote Code Execution (RCE), Full Server Compromise

Executive Summary

CVE-2025-15067 is a critical, unauthenticated remote code execution vulnerability in Innorix WP, a file transfer platform widely deployed across South Korean enterprises, including financial institutions, government agencies, and administrative systems.

The vulnerability allows any remote attacker to upload malicious files—such as PHP web shells—directly to the server without authentication or validation, provided the exam directory exists under the Innorix WP installation path (for example: innorix/exam).

This is not a hypothetical threat. Innorix products have already been exploited in real-world attacks. Earlier in 2025, the Lazarus Group abused similar Innorix flaws during Operation SyncHole, compromising organizations across software, IT, financial, semiconductor, and telecom sectors.

CVE-2025-15067 presents the same attack conditions that made those campaigns successful:

public exposure
no authentication
minimal attacker skill required
immediate command execution

If exploited, an attacker can fully take over the server, pivot internally, and maintain long-term persistence.

Technical Analysis

Vulnerability Description

At its core, this issue is simple—and extremely dangerous.

When the exam directory exists, Innorix WP fails to enforce any meaningful controls on uploaded files. The application accepts attacker-supplied files and stores them in a web-accessible location where the server is allowed to execute scripts.

The following security controls are missing:

No MIME-type validation
No file extension allowlist or denylist
No content inspection
No execution restrictions on upload directories
No authentication or authorization checks

This combination directly enables web shell deployment.

How the Vulnerability Is Exploited

A real-world attack would typically follow this exact chain:

1. Reconnaissance

The attacker scans for Innorix WP installations and checks whether the path below is reachable:

/innorix/exam/

This can be identified using basic HTTP requests or automated scanners.

2. Payload Preparation

The attacker prepares a malicious script based on the server stack:

PHP for Apache/Nginx
JSP for Java environments
ASP/ASPX for IIS

Common payloads include:

China Chopper
WSO Shell
Custom one-line command shells

3. Upload

Using the vulnerable upload endpoint, the attacker sends a crafted POST request containing the malicious file.
No login, no bypass, no trickery required.

4. Execution

The attacker accesses the uploaded file directly:

http://target/innorix/exam/shell.php

5. Post-Exploitation

From here, the attacker can:

Execute OS commands
Dump credentials
Access databases
Move laterally
Deploy malware or ransomware
Maintain persistence indefinitely

At this stage, the server is considered fully compromised.

Example Malicious Payload

A minimal but effective PHP web shell:

<?php system($_GET['cmd']); ?>

This allows remote command execution simply by passing parameters in the URL.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Relevance
T1190	Exploit Public-Facing Application	Initial access via vulnerable Innorix endpoint
T1505.003	Server Software Component: Web Shell	Primary persistence method
T1059	Command and Scripting Interpreter	OS command execution
T1136	Create Account	Backdoor account creation
T1570	Lateral Tool Transfer	Internal movement
T1041	Exfiltration Over C2 Channel	Data theft via web shell

Detection Strategies

Log Sources to Monitor

To detect exploitation attempts and post-compromise activity, monitor:

Web Server Logs (Apache / Nginx / IIS)
- POST requests to /innorix/exam/
- Uploads with script extensions
- Immediate GET requests to uploaded files
Web Application Firewall (WAF) Logs
- File upload violations
- Suspicious multipart requests
File Integrity Monitoring (FIM)
- New or modified files in Innorix directories
Endpoint / EDR Telemetry
- Web server processes spawning shells
Network Traffic Logs
- Unexpected outbound connections from web servers

YARA Rule – Web Shell Detection

rule Webshell_Generic_PHP
{
    meta:
        description = "Detects generic PHP web shells"
        author = "SOC Team"
        reference = "CVE-2025-15067"
        severity = "critical"
    strings:
        $php_tag = "<?php" nocase
        $eval1 = /eval\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/ nocase
        $eval2 = /system\s*\(\s*\$_(GET|POST|REQUEST)/ nocase
        $eval3 = /passthru\s*\(/ nocase
        $eval4 = /shell_exec\s*\(/ nocase
        $eval5 = /exec\s*\(\s*\$/ nocase
        $base64 = /base64_decode\s*\(\s*\$_(GET|POST|REQUEST)/ nocase
        $preg = /preg_replace\s*\([^)]*\/[^)]*e/ nocase
    condition:
        $php_tag and (any of ($eval*) or $base64 or $preg)
}

Sigma Rule – Web Server Command Execution

title: Web Shell Command Execution via Web Server
id: cve-2025-15067-webshell
status: experimental
description: Detects command execution from web server processes
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_parent and selection_child
level: high
tags:
    - attack.persistence
    - attack.t1505.003

KQL – Microsoft Sentinel / Defender

let timeframe = 24h;
CommonSecurityLog
| where TimeGenerated > ago(timeframe)
| where RequestURL contains "innorix" and RequestURL contains "exam"
| where RequestMethod == "POST"
| where RequestURL matches regex @"\.(php|jsp|asp|aspx|jspx|phtml)$"
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, UserAgent
| order by TimeGenerated desc

DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath contains "innorix"
| where FileName matches regex @"\.(php|jsp|asp|aspx|jspx)$"
| where ActionType == "FileCreated"

Mitigation and Remediation

Immediate Actions

Delete or rename the exam directory immediately
Scan for existing web shells
Review historical web server logs
Disable script execution in upload paths
Deploy WAF rules blocking dangerous extensions

Long-Term Hardening

Strict file type validation
Store uploads outside web root
Disable script execution by default
Implement File Integrity Monitoring
Network segmentation
Regular vulnerability scanning

Official Patch Information (Only Official Source)

Patched Version: Innorix Agent 9.2.18.539 and later
Patch Advisory: KrCERT Security Advisory (March 2025)
Official Patch Link:
https://www.krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71686
Vendor Support:
https://www.innorix.com/en/support

Threat Context

This vulnerability aligns closely with techniques used by the Lazarus Group, whose prior exploitation of Innorix software demonstrates both intent and capability. Even if your organization is not a nation-state target, the same techniques are widely used by ransomware groups and commodity attackers.

Final Takeaway

CVE-2025-15067 is not optional to fix.
It is easy to exploit, hard to detect once active, and catastrophic if ignored.

If Innorix WP exists in your environment:

remove the exam directory
apply patches
deploy detection rules
assume compromise until proven otherwise

Act now, not after an incident report.