Cyber Resilience

CVE-2025-1890

MediumPublic PoC

Published: 04 March 2025

Published
04 March 2025
Modified
05 March 2025
KEV Added
Patch
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0021 43.5th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1890 is a medium-severity Improper Access Control (CWE-284) vulnerability in Shishuocms Project Shishuocms. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-1890 is a critical vulnerability in shishuocms version 1.1, affecting the handleRequest function in the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. It allows unrestricted file upload through manipulation of the 'file' argument. The issue is remotely exploitable and has been assigned CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An attacker with low-privilege remote access, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially through uploading malicious files that could lead to further compromise depending on server configuration.

Advisories and details are available from sources including VulDB (ctiid.298408, id.298408, submit.505736) and a GitHub repository at https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md. No specific patch or mitigation guidance is detailed in the initial disclosure.

The exploit has been publicly disclosed and may be in use, as noted in the vulnerability entry published on 2025-03-04.

EU & UK References

Vulnerability details

A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit…

more

has been disclosed to the public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted file upload vuln (CWE-434) in web app directly enables public-facing app exploitation (T1190), ingress tool transfer (T1105), and web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-1107Shared CWE-284, CWE-434
CVE-2025-0722Shared CWE-284, CWE-434
CVE-2025-2687Shared CWE-284, CWE-434
CVE-2026-4221Shared CWE-284, CWE-434
CVE-2024-13133Shared CWE-284, CWE-434
CVE-2026-1424Shared CWE-284, CWE-434
CVE-2025-0460Shared CWE-284, CWE-434
CVE-2025-2350Shared CWE-284, CWE-434
CVE-2025-1166Shared CWE-284, CWE-434
CVE-2025-2115Shared CWE-284, CWE-434

Affected Assets

shishuocms project
shishuocms
1.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Mandates timely identification, reporting, and correction of the unrestricted file upload flaw in handleRequest, directly preventing exploitation of this CVE.

prevent

Implements input validation mechanisms at the upload entry point to block manipulation of the 'file' argument and unrestricted upload of dangerous types.

prevent

Enforces approved access authorizations to the ManageUpLoadAction handler, addressing CWE-284 improper access control exploited by low-privilege remote users.

References