CVE-2022-25487

What it actually does

Atom CMS v2.0 contains an unauthenticated remote code execution vulnerability in /admin/uploads.php. Because the CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction, an attacker can remotely reach the upload handler and cause attacker-controlled code to execute on the web server. Successful exploitation can provide full confidentiality, integrity, and availability impact for the application and potentially the underlying host, depending on web server permissions and segmentation.

Why it matters to the business

A successful attack can allow an external attacker to take over the affected Atom CMS site, modify or delete web content, steal data accessible to the application, install web shells or malware, pivot further into connected infrastructure, and disrupt public-facing services. The high CVSS score, weaponized exploit maturity, and elevated EPSS score indicate meaningful real-world exploitation likelihood even though this vulnerability is not currently listed in CISA KEV. Organizations still running Atom CMS v2.0 should treat internet-exposed instances as high priority for remediation or isolation.

How an attack unfolds

An attacker first identifies an exposed Atom CMS v2.0 instance, typically by fingerprinting the website, administrative paths, page structure, or known Atom CMS assets. The attacker then sends a crafted request to /admin/uploads.php designed to abuse the upload functionality and place or execute server-side code. If the server accepts the malicious upload or processes it unsafely, the attacker invokes the uploaded payload or otherwise triggers execution through the web server. From there, the attacker can run commands with the privileges of the web server process, establish persistence through a web shell, read configuration files and credentials, alter site content, upload additional tooling, or use the compromised host for lateral movement.

How to fix it

Upgrade Atom CMS to a version that is not affected by this vulnerability if a maintained fixed release is available from the vendor. No fixed version was provided in the supplied vulnerability data, so organizations should consult the Atom CMS project/vendor for patched releases or advisories. If no supported patched release exists, migrate away from Atom CMS v2.0 or remove it from production. As immediate mitigations, restrict access to /admin/uploads.php and all administrative paths to trusted networks or VPNs, disable or remove upload functionality if not required, enforce strict server-side file type validation, block execution in upload directories, remove execute permissions from writable web directories, configure the web server to prevent PHP or other dynamic execution from upload paths, and place the site behind a WAF rule that blocks suspicious multipart uploads and script extensions. Review and remove any unauthorized uploaded files after patching or mitigation.

How to confirm the fix worked

Confirm exposure by inventorying all Atom CMS deployments and verifying whether any instance is running v2.0 or exposes /admin/uploads.php to untrusted networks. Validate remediation by confirming the application has been upgraded, replaced, or isolated; that /admin/uploads.php is inaccessible to unauthenticated external users where possible; and that uploaded files cannot execute as code. Test by attempting to upload benign files with executable extensions such as .php, .phtml, or .phar and confirming they are rejected, stored outside the web root, or served as inert downloads. Review web server configuration to ensure writable upload directories do not allow script execution. Run authenticated file integrity checks against the web root and upload directories to verify no suspicious scripts or web shells remain.

Typical attack path

1. Scan the internet or targeted address ranges for Atom CMS v2.0 websites.
2. Fingerprint the application and confirm the /admin/uploads.php endpoint is reachable.
3. Submit a crafted upload request containing executable server-side code or a payload that abuses the upload handler.
4. Trigger the uploaded payload or vulnerable code path to execute commands on the server.
5. Deploy a web shell or remote access mechanism for persistence.
6. Enumerate application files, configuration secrets, databases, and local operating system context.
7. Modify content, exfiltrate data, deploy malware, or pivot to adjacent systems depending on access obtained.

How to detect it

To determine whether this vulnerability was already exploited, review HTTP access logs, reverse proxy logs, WAF events, application logs, file creation timestamps, EDR telemetry, and command execution history on servers hosting Atom CMS. Look for POST requests to /admin/uploads.php, especially unauthenticated or internet-originating requests, multipart form-data uploads, attempts to upload files with executable extensions, and subsequent GET or POST requests to newly uploaded .php, .phtml, .phar, .asp, .jsp, or similarly executable files. Examine upload directories and the web root for recently created or modified scripts, obfuscated PHP code, web shells, one-line command execution patterns, unexpected archive extraction, or files with image-like names but script contents. Correlate suspicious upload activity with web server child processes spawning shells or utilities such as sh, bash, cmd, powershell, curl, wget, python, perl, nc, or php. Also inspect outbound network connections from the web server shortly after upload events, particularly to unfamiliar IPs or high-risk hosting providers. Because the exploit is weaponized and EPSS is elevated, absence from KEV should not be treated as absence of exploitation risk.

• /admin/uploads.php
• POST /admin/uploads.php
• multipart/form-data
• filename="*.php"
• filename="*.phtml"
• filename="*.phar"
• filename="*.php5"
• filename="*.shtml"
• GET *.php
• POST *.php
• <?php
• eval($_POST
• eval($_REQUEST
• assert($_POST
• assert($_REQUEST
• system($_GET
• system($_POST
• shell_exec(
• passthru(
• base64_decode(
• gzinflate(
• str_rot13(
• preg_replace('/.*/e'
• move_uploaded_file(
• FilesMan
• WSO
• c99shell
• r57shell
• b374k
• cmd.php
• shell.php
• upload.php
• wso.php
• c99.php
• r57.php
• webshell.php
• php -r
• /bin/sh -c
• /bin/bash -c
• wget http
• curl http
• nc -e
• bash -i

What your security team should do

• Immediately identify all internet-facing Atom CMS instances and prioritize any running v2.0 for remediation.
• If Atom CMS v2.0 is exposed to the internet, temporarily restrict access to administrative and upload endpoints until the platform is upgraded, replaced, or safely configured.
• Search web roots and upload directories for unauthorized PHP or script files, especially files created after the vulnerability publication date.
• Review web, application, EDR, and file integrity logs for upload attempts to /admin/uploads.php followed by requests to newly created executable files.
• Harden web server configuration so uploaded content cannot execute, even if a future upload validation bypass is discovered.
• Rotate credentials stored in application configuration files if compromise is suspected, including database, API, SMTP, and administrative credentials.
• Increase monitoring for web shell behavior such as unusual child processes spawned by the web server, outbound connections from the web server, or command execution utilities.
• If exploitation is confirmed, preserve logs and disk artifacts, isolate the host, perform full incident response scoping, and rebuild from a known-good image rather than only deleting visible payloads.