Cyber Posture

CVE-2025-0335

MediumPublic PoC

Published: 09 January 2025

Published
09 January 2025
Modified
23 October 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0008 22.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2025-0335 is a critical vulnerability in code-projects Online Bike Rental System 1.0, affecting an unknown functionality within the Change Image Handler component. The issue enables unrestricted file upload through remote manipulation, with potential impacts on other endpoints as well. It is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An authenticated attacker with low privileges can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation leads to unrestricted file upload, resulting in low-level impacts on confidentiality, integrity, and availability.

Advisories from VulDB indicate the exploit has been publicly disclosed and is available for use, including a proof-of-concept on GitHub at https://github.com/Huandtx/cve/blob/main/cve/Online%20Bike%20Rental%20System/File_upload1.md. Additional references include the project site at https://code-projects.org/ and VulDB entries at https://vuldb.com/?ctiid.290822, https://vuldb.com/?id.290822, and https://vuldb.com/?submit.475365; no patches or specific mitigations are detailed in the provided information.

Details

CWE(s)
CWE-284CWE-434

Affected Products

fabian
online bike rental system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1608.002 Upload Tool Resource Development
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

Unrestricted file upload in public-facing web application enables exploitation of public-facing apps (T1190), deployment of web shells (T1100), and uploading tools (T1608.002).

References