CVE-2025-1676
Published: 25 February 2025
Summary
CVE-2025-1676 is a medium-severity Command Injection (CWE-77) vulnerability in Hzmanyun Education And Training System. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the OS command injection vulnerability in the pdf2swf function by identifying, prioritizing, and applying patches or updates to the affected hzmanyun Education and Training System.
Prevents command injection by enforcing validation of the 'file' argument to the /pdf2swf endpoint, rejecting or sanitizing inputs that could contain malicious OS commands.
Limits the scope and impact of injected OS commands by enforcing least privilege on the process handling the pdf2swf function, restricting unauthorized actions even if exploitation occurs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in remotely accessible pdf2swf endpoint directly enables exploitation of public-facing application (T1190) and arbitrary command execution via T1059.
NVD Description
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1676 is a critical vulnerability in the hzmanyun Education and Training System version 3.1.1, specifically affecting the pdf2swf function within the /pdf2swf file. The issue arises from manipulation of the "file" argument, enabling OS command injection, and is linked to CWE-77 and CWE-78. It was published on 2025-02-25 with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation allows injection and execution of arbitrary operating system commands on the affected system, potentially compromising confidentiality, integrity, and availability to a low degree.
Advisories and further details are documented on VulDB (https://vuldb.com/?ctiid.296731, https://vuldb.com/?id.296731, https://vuldb.com/?submit.500507) and a GitHub report (https://github.com/Rain1er/report/blob/main/nxb/rce1.md). The exploit has been publicly disclosed and may be used.
The vulnerability's public exploit availability increases the risk of active exploitation in environments running the affected software.
Details
- CWE(s)