Cyber Posture

CVE-2025-2193

MediumPublic PoC

Published: 11 March 2025

Published
11 March 2025
Modified
09 April 2025
KEV Added
Patch
CVSS Score 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0031 54.1th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2193 is a path traversal vulnerability (CWE-22) classified as critical in MRCMS version 3.1.2. It affects the delete function in the file /admin/file/delete.do within the component org.marker.mushroom.controller.FileController, where manipulation of the path/name argument enables the issue.

The vulnerability allows remote exploitation by low-privileged users (PR:L) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful attacks result in low integrity (I:L) and availability (A:L) impacts but no confidentiality loss (C:N), yielding a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

Advisories from VulDB indicate the vendor was contacted early about the disclosure but provided no response, with no patches mentioned. The exploit has been publicly disclosed via a GitHub issue and may be in use.

Details

CWE(s)
CWE-22

Affected Products

mrcms
mrcms
3.1.2

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated path traversal in public-facing web app delete endpoint enables exploitation of public-facing application (T1190), exploitation for privilege escalation (T1068 via vertical escalation to admin file delete), and arbitrary file deletion (T1070.004 for indicator removal or impact).

References