CVE-2025-0328

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A critical command injection vulnerability has been identified in the KaiYuanTong ECT Platform up to version 2.0.0. The flaw resides in the HTTP POST Request Handler component, specifically within the file /public/server/runCode.php, where unsanitized input to the "code" argument is passed to an underlying system command. This corresponds to CWE-74 and CWE-77 weaknesses and permits remote, unauthenticated attackers to inject and execute arbitrary operating-system commands.

An attacker can send a crafted HTTP POST request to the affected endpoint and achieve limited control over confidentiality, integrity, and availability on the target system. No user interaction or credentials are required, and the attack complexity is low. A public exploit has already been disclosed, enabling straightforward reproduction by threat actors with network access to the platform.

The vendor was notified prior to disclosure but did not respond or issue a patch. Public references, including detailed technical notes, confirm the issue is exploitable in default configurations. The associated EPSS score rose from a low baseline to a peak of 0.0214, indicating emerging exploitation interest after publication.