CVE-2025-29017
Published: 10 April 2025
Summary
CVE-2025-29017 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Codeastro Internet Banking System. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 26.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A Remote Code Execution vulnerability tracked as CVE-2025-29017 affects Code Astro Internet Banking System version 2.0.0. The flaw stems from missing validation on the profile_pic parameter in pages_view_client.php, allowing an attacker to upload arbitrary files that can subsequently be executed on the server. The issue carries a CVSS 3.1 score of 8.8 and is classified under CWE-434.
An authenticated user with low privileges can exploit the weakness over the network without user interaction. Successful exploitation grants the attacker the ability to run arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected banking application.
A publicly available proof-of-concept exists at the referenced GitHub repository. The associated EPSS score rose from a low baseline to a peak of 0.0202 on 2026-02-04 before receding to its current value of 0.0076, indicating a temporary increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10697
Vulnerability details
A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.