CVE-2025-1890
Published: 04 March 2025
Summary
CVE-2025-1890 is a medium-severity Improper Access Control (CWE-284) vulnerability in Shishuocms Project Shishuocms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1890 is a critical vulnerability in shishuocms version 1.1, affecting the handleRequest function in the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. It allows unrestricted file upload through manipulation of the 'file' argument. The issue is remotely exploitable and has been assigned CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low-privilege remote access, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially through uploading malicious files that could lead to further compromise depending on server configuration.
Advisories and details are available from sources including VulDB (ctiid.298408, id.298408, submit.505736) and a GitHub repository at https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md. No specific patch or mitigation guidance is detailed in the initial disclosure.
The exploit has been publicly disclosed and may be in use, as noted in the vulnerability entry published on 2025-03-04.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7416
Vulnerability details
A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit…
more
has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload vuln (CWE-434) in web app directly enables public-facing app exploitation (T1190), ingress tool transfer (T1105), and web shell deployment (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of the unrestricted file upload flaw in handleRequest, directly preventing exploitation of this CVE.
Implements input validation mechanisms at the upload entry point to block manipulation of the 'file' argument and unrestricted upload of dangerous types.
Enforces approved access authorizations to the ManageUpLoadAction handler, addressing CWE-284 improper access control exploited by low-privilege remote users.