CVE-2025-2115
Published: 09 March 2025
Summary
CVE-2025-2115 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zzskzy Warehouse Refinement Management System. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked at the 11.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the manipulated 'file' argument in /AcceptZip.ashx to block unrestricted upload of dangerous files.
Restricts file types, sizes, and characteristics accepted by the ProcessRequest function to prevent unrestricted uploads.
Enforces proper access control on the /AcceptZip.ashx endpoint to mitigate CWE-284 improper access allowing low-privilege exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web application (/AcceptZip.ashx) enables exploitation of public-facing application (T1190), ingress tool transfer via arbitrary file upload (T1105), and deployment/execution of web shells or malicious files leading to RCE (T1505.003).
NVD Description
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-2115 is a vulnerability classified as critical in the zzskzy Warehouse Refinement Management System version 3.1. It affects the ProcessRequest function within the /AcceptZip.ashx file, where manipulation of the 'file' argument enables unrestricted file upload. The issue corresponds to CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-03-09.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation allows limited impacts on confidentiality, integrity, and availability, primarily through the upload of arbitrary files, which could facilitate further compromise depending on server configurations.
Advisories from VulDB and a related GitHub report indicate that the exploit has been publicly disclosed and may be used in attacks. The vendor was contacted early regarding the issue but provided no response, resulting in no available patches or official mitigations at this time.
Details
- CWE(s)