CVE-2014-125126 Simple E-Document Arbitrary File Upload RCE
Unauthenticated attackers can bypass authentication and upload malicious PHP scripts to achieve remote code execution on the web server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-125126?
CVE-2014-125126 is a critical vulnerability in Simple E-Document, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.
Which versions are affected by CVE-2014-125126?
How do I fix CVE-2014-125126?
No fix has been published for CVE-2014-125126 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-125126 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125126 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-gm48-jxxv-q9v4.