Cyber Posture

CVE-2025-2978

MediumPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
09 October 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0033 55.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2025-2978 is a vulnerability in WCMS 11 rated as critical, affecting unknown functionality within the Article Publishing Page component at the endpoint /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1. The issue enables unrestricted file upload through manipulation of the Upload argument and is associated with CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-31.

The vulnerability is exploitable remotely by low-privileged users, as indicated by the PR:L requirement, with low attack complexity and no need for user interaction. Attackers can achieve low impacts on confidentiality, integrity, and availability through the unrestricted upload, potentially allowing further compromise depending on the uploaded content.

VulDB advisories detail the issue and reference a publicly disclosed proof-of-concept on GitHub demonstrating the upload leading to remote code execution (RCE). The vendor was contacted early regarding the disclosure but provided no response, and no patches or mitigations are mentioned in available references.

The exploit has been publicly disclosed and may be used in attacks, with no further details on real-world exploitation provided.

Details

CWE(s)
CWE-284CWE-434

Affected Products

wcms
wcms
11.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1608.001 Upload Malware Resource Development
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
T1608.002 Upload Tool Resource Development
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

Unrestricted file upload in public-facing WCMS 11 web application (T1190) enables uploading malware/tools (T1608.001/.002) such as PHP webshells (T1505.003) for RCE.

References