CVE-2025-1555
Published: 21 February 2025
Summary
CVE-2025-1555 is a high-severity Improper Access Control (CWE-284) vulnerability in Hzmanyun Education And Training System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents unrestricted file uploads by requiring validation of the manipulated file argument in the saveImage function to ensure only authorized and safe files are processed.
SI-2 mandates timely identification, reporting, and correction of flaws like this critical unrestricted upload vulnerability in the hzmanyun system.
SI-3 provides malicious code protection mechanisms to scan and block dangerous files that could be uploaded through the saveImage vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web app directly enables remote exploitation (T1190) and arbitrary file ingress (T1105), commonly used to deploy web shells (T1505.003).
NVD Description
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been…
more
disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-1555 is a critical vulnerability in hzmanyun Education and Training System 3.1.1, affecting the saveImage function. It enables unrestricted file upload through manipulation of the file argument, classified under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-21.
Remote attackers can exploit this vulnerability without privileges or user interaction, initiating the attack over the network with low complexity. Successful exploitation allows uploading arbitrary files, resulting in low impacts to confidentiality, integrity, and availability.
Advisories from VulDB and a related GitHub report indicate that the vendor was contacted early about the disclosure but provided no response or patches. The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)