CVE-2025-0346
Published: 09 January 2025
Summary
CVE-2025-0346 is a medium-severity Improper Access Control (CWE-284) vulnerability in Code-Projects Content Management System. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2025-0346 is a critical vulnerability in code-projects Content Management System version 1.0, affecting the /admin/publishnews.php file within the Publish News Page component. The issue stems from manipulation of the 'image' argument, enabling unrestricted file upload. Classified under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), it carries a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-09.
An attacker with high privileges, such as an authenticated administrator, can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts: low confidentiality, integrity, and availability effects, potentially through uploading malicious files via the vulnerable endpoint.
Advisories and related details are documented on VulDB (ctiid.290859, id.290859, submit.476728), the project site at code-projects.org, and a public exploit gist at github.com/Lytes/266e5fa6eb4506fe2c7e35166664249a. No specific patch or mitigation steps are detailed in the available references.
The exploit has been publicly disclosed and may be actively used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1617
Vulnerability details
A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted…
more
upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unrestricted file upload vulnerability in the admin panel allows authenticated attackers to upload PHP webshells disguised as images, enabling web shell deployment (T1100, T1505.003), exploitation of a public-facing application (T1190), and staging of tools (T1608.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents exploitation by validating the 'image' argument in /admin/publishnews.php to reject dangerous or invalid file uploads.
Restricts the types and quantities of files accepted via the 'image' parameter, blocking unrestricted uploads of dangerous types in the Publish News Page component.
Scans and eradicates malicious code in files uploaded through the vulnerable endpoint, mitigating impacts even if uploads succeed.