CVE-2025-1891
Access Control in Qzw1210 Shishuocms 1.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-1891 is a medium-severity CSRF (CWE-352) vulnerability in Qzw1210 Shishuocms. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-1891 is a cross-site request forgery (CSRF) vulnerability, classified as problematic, affecting shishuocms version 1.1. The issue impacts some unknown processing within the software and is associated with CWE-352 (Cross-Site Request Forgery) and CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no required privileges, and user interaction needed.
An attacker can exploit this vulnerability remotely by manipulating a victim into submitting a malicious request, such as via a crafted link or form on a malicious site. No attacker privileges are required, but the victim must be authenticated to shishuocms and interact with the attacker's payload. Successful exploitation enables limited integrity impacts, potentially allowing unauthorized actions on the victim's behalf without affecting confidentiality or availability.
References from VulDB and a GitHub repository document the vulnerability, noting that the exploit has been publicly disclosed and may be used. No specific patches, vendor advisories, or mitigation guidance are detailed in the provided sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7417
Vulnerability Data
A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may…
more
be used.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization decisions on every access request, structurally eliminating missing authorization checks.
AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.
AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.
AC-6 reduces the set of actions reachable without proper authorization, limiting blast radius of missing checks.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).
A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce authorization decisions, which squarely stops exploitation of missing authorization (CWE-862); the bounded remainder is non-access mechanisms such as path traversal or CSRF that are outside its scope per the AC-3/A01:2025 anchor.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.
Requiring evidence of minimum security capabilities and acceptance testing ensures that missing or bypassed authorization checks are detected before the delivered software is accepted.
Mandating read-only access or proxy execution by an authorized administrator ensures every requested operation is explicitly authorized before it occurs.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-862, a class-level weakness, and none of its children carries one either.