CVE-2025-0399
Published: 12 January 2025
Description
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0399 is a critical vulnerability in StarSea99 starsea-mall version 1.0 that enables unrestricted file upload. It affects the UploadController function in the file src/main/java/com/siro/mall/controller/common/uploadController.java, where manipulation of the 'file' argument allows attackers to upload arbitrary files. The issue is remotely exploitable and has been assigned CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with high privileges (PR:H) can exploit this vulnerability by submitting a malicious 'file' argument to the UploadController, leading to unrestricted file upload. Successful exploitation results in low-level impacts on confidentiality, integrity, and availability, potentially allowing limited data exposure, modification, or disruption depending on the uploaded file's nature and server configuration.
Advisories and details are documented in the StarSea99/starsea-mall GitHub repository issues #3 and #3#issue-2765550309, as well as on VulDB entries at ctiid.291274, id.291274, and submit.473319, where the public disclosure of the exploit is noted.
The exploit has been publicly disclosed, increasing the risk of targeted attacks against deployments requiring high-privilege access.
Details
- CWE(s)