CVE-2025-0460
Published: 14 January 2025
Summary
CVE-2025-0460 is a medium-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2025-0460 is a critical vulnerability in Blog Botz for Journal Theme version 1.0 running on OpenCart. It affects an unknown functionality within the file /index.php?route=extension/module/blog_add, where manipulation of the image argument enables unrestricted file upload. Classified under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), the issue carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, primarily through uploading arbitrary files, which could facilitate further compromise depending on server configuration and file handling.
VulDB advisories detail the issue but note no vendor response despite early contact, with no patches or official mitigations available. The exploit PoC has been publicly disclosed via a GitHub gist, increasing the risk of active use.
In context, the vulnerability was published on January 14, 2025, and the public exploit disclosure heightens the urgency for OpenCart users employing this module to review and potentially disable or replace Blog Botz for Journal Theme 1.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1688
Vulnerability details
A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible…
more
to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing OpenCart web module directly enables remote exploitation (T1190) to deploy web shells (T1505.003) or transfer malicious files (T1105).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents unrestricted file upload by validating the 'image' argument for expected file types, sizes, and content to block dangerous files.
Restricts inputs to the affected endpoint to only permitted file types and volumes, mitigating CWE-434 unrestricted upload of dangerous files.
Enforces access controls on the vulnerable /index.php?route=extension/module/blog_add endpoint to address CWE-284 improper access control allowing unauthenticated uploads.