CVE-2025-0582
Published: 20 January 2025
Summary
CVE-2025-0582 is a medium-severity Improper Access Control (CWE-284) vulnerability in Angeljudesuarez Tailoring Management System. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0582 is a vulnerability classified as critical in the itsourcecode Farm Management System up to version 1.0, affecting unknown code in the /add-pig.php file. It enables unrestricted upload through manipulation of the pigphoto argument and can be exploited remotely, as published on 2025-01-20. The issue is scored at CVSS 4.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 284 (Improper Access Control) and 434 (Unrestricted Upload of File with Dangerous Type).
Attackers with high privileges (PR:H) can exploit this over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts, including low-level disclosure or modification of data (C:L/I:L) and minor denial of service (A:L), without scope change.
Advisories and further details are documented in references such as the GitHub issue at https://github.com/yunhai666/cve/issues/2, the vendor site at https://itsourcecode.com/, and VulDB entries at https://vuldb.com/?ctiid.292600, https://vuldb.com/?id.292600, and https://vuldb.com/?submit.484909, where mitigation guidance may be available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1778
Vulnerability details
A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig.php. The manipulation of the argument pigphoto leads to unrestricted upload. The attack can be initiated remotely.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload vulnerability in public-facing web application (/add-pig.php) allows remote exploitation for initial access (T1190) and uploading/executing web shells containing arbitrary PHP code for code execution and persistence (T1100, T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents unrestricted upload by validating the pigphoto argument for file type, size, and content to block dangerous files.
Remediates the specific code flaw in /add-pig.php that enables the unrestricted file upload vulnerability.
Scans and eradicates malicious code in uploaded pigphoto files, providing defense-in-depth against CWE-434 exploitation.