Cyber Posture

CVE-2025-29411

CriticalPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
28 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 45.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-29411, published on 2025-03-20, is an arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0. The flaw enables attackers to upload a crafted PHP file, resulting in arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Unauthenticated attackers with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation allows remote code execution, granting high-impact access to confidentiality, integrity, and availability of the affected system.

Advisories and further details are documented in the GitHub issue at https://github.com/MartMbithi/iBanking/issues/12 and the analysis at https://www.simonjuguna.com/cve-2025-29411-authenticated-remote-code-execution-rce-via-arbitrary-file-upload/. No specific patch or mitigation guidance is detailed in the provided information.

Details

CWE(s)
CWE-434

Affected Products

martmbithi
ibanking
2.0.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

The arbitrary file upload vulnerability in a public-facing web application directly enables exploitation of T1190 (Exploit Public-Facing Application) and facilitates deployment of a malicious PHP file as a web shell under T1505.003 (Server Software Component: Web Shell), leading to unauthenticated remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References