CVE-2025-15426
📋 TL;DR
This vulnerability in jackying H-ui.admin allows attackers to upload arbitrary files without restrictions via the /lib/webuploader/0.1.5/server/preview.php endpoint. This can lead to remote code execution on affected systems. Organizations using H-ui.admin up to version 3.1 are vulnerable.
💻 Affected Systems
- jackying H-ui.admin
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Webshell deployment leading to persistent access, data exfiltration, or use as part of a botnet.
If Mitigated
File upload attempts blocked at WAF or detected by security monitoring before successful exploitation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider removing or replacing H-ui.admin with alternative software.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the vulnerable preview.php file via web server configuration
# Apache: Add to .htaccess or virtual host config
<Files "preview.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /lib/webuploader/0.1.5/server/preview\.php$ {
deny all;
return 403;
}
Remove vulnerable file
linuxDelete the vulnerable preview.php file from the server
rm /path/to/webroot/lib/webuploader/0.1.5/server/preview.php
🧯 If You Can't Patch
- Implement strict file upload validation and whitelisting for all upload functionality
- Deploy web application firewall (WAF) with rules to block malicious file upload attempts
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /lib/webuploader/0.1.5/server/preview.php in web directory. Test by attempting to upload a file to this endpoint.Check Version:
Check H-ui.admin version in admin panel or look for version markers in source filesVerify Fix Applied:
Verify preview.php file is removed or returns 403/404. Test file upload functionality is properly restricted.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /lib/webuploader/0.1.5/server/preview.php
- File uploads with suspicious extensions (.php, .jsp, .asp)
- Unusual file creation in web directories
Network Indicators:
- POST requests to preview.php endpoint with file uploads
- Traffic patterns matching known exploit payloads
SIEM Query:
source="web_server" AND (url="/lib/webuploader/0.1.5/server/preview.php" OR file_extension IN ("php", "jsp", "asp"))