CVE-2025-1791
Published: 01 March 2025
Summary
CVE-2025-1791 is a medium-severity Improper Access Control (CWE-284) vulnerability in Skycaiji Skycaiji. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-1791 by identifying, reporting, and correcting the flaw in the fileAction function to prevent unrestricted file uploads.
Validates the manipulated save_data argument in Tool.php to block unrestricted uploads of dangerous file types.
Enforces access control policies on the fileAction function to restrict unauthorized or improper file upload operations despite low-privilege access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web application (T1190) enables staging of malware/tools (T1608.001, T1608.002) and deployment of web shells for execution/persistence (T1100, T1505.003), leading to RCE.
NVD Description
A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data leads to unrestricted upload. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1791 is a critical vulnerability in Zorlan SkyCaiji version 2.9, affecting the fileAction function within the file vendor/skycaiji/app/admin/controller/Tool.php. The issue arises from manipulation of the save_data argument, enabling unrestricted file upload. Published on 2025-03-01, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is linked to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation allows limited impacts to confidentiality, integrity, and availability, potentially enabling attackers to upload malicious files.
Advisories referenced in VulDB entries (ctiid.298012, id.298012, submit.502648) and a GitHub issue (sheratan4/cve/issues/5) document the vulnerability. The exploit has been publicly disclosed and may be used by attackers. No specific patches or mitigation steps are detailed in the provided information.
Details
- CWE(s)