Cyber Posture

CVE-2025-1890

MediumPublic PoC

Published: 04 March 2025

Published
04 March 2025
Modified
05 March 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0021 43.2th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-1890 is a critical vulnerability in shishuocms version 1.1, affecting the handleRequest function in the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. It allows unrestricted file upload through manipulation of the 'file' argument. The issue is remotely exploitable and has been assigned CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An attacker with low-privilege remote access, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially through uploading malicious files that could lead to further compromise depending on server configuration.

Advisories and details are available from sources including VulDB (ctiid.298408, id.298408, submit.505736) and a GitHub repository at https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md. No specific patch or mitigation guidance is detailed in the initial disclosure.

The exploit has been publicly disclosed and may be in use, as noted in the vulnerability entry published on 2025-03-04.

Details

CWE(s)
CWE-284CWE-434

Affected Products

shishuocms project
shishuocms
1.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload vuln (CWE-434) in web app directly enables public-facing app exploitation (T1190), ingress tool transfer (T1105), and web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References