Cyber Posture

CVE-2025-2115

MediumPublic PoC

Published: 09 March 2025

Published
09 March 2025
Modified
27 June 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 10.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-2115 is a vulnerability classified as critical in the zzskzy Warehouse Refinement Management System version 3.1. It affects the ProcessRequest function within the /AcceptZip.ashx file, where manipulation of the 'file' argument enables unrestricted file upload. The issue corresponds to CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-03-09.

Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation allows limited impacts on confidentiality, integrity, and availability, primarily through the upload of arbitrary files, which could facilitate further compromise depending on server configurations.

Advisories from VulDB and a related GitHub report indicate that the exploit has been publicly disclosed and may be used in attacks. The vendor was contacted early regarding the issue but provided no response, resulting in no available patches or official mitigations at this time.

Details

CWE(s)
CWE-284CWE-434

Affected Products

zzskzy
warehouse refinement management system
3.1

MITRE ATT&CK Enterprise Techniques

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload in public-facing web application (/AcceptZip.ashx) enables exploitation of public-facing application (T1190), ingress tool transfer via arbitrary file upload (T1105), and deployment/execution of web shells or malicious files leading to RCE (T1505.003).

References