CVE-2025-8504
Published: 03 August 2025
Summary
CVE-2025-8504 is a low-severity Improper Access Control (CWE-284) vulnerability in Anisha Kitchen Treasure. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-8504 is a critical vulnerability in code-projects Kitchen Treasure 1.0, affecting an unknown part of the file /userregistration.php. The issue enables unrestricted file upload through manipulation of the photo argument and can be initiated remotely.
Attackers with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Per the CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), successful exploitation results in low impacts to confidentiality, integrity, and availability. The vulnerability is linked to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories and additional details are documented on VulDB (ctiid.318603, id.318603, submit.626935), a GitHub issue at freshfish-hust/my-cves/issues/4, and code-projects.org. The exploit has been publicly disclosed and may be used.
This vulnerability was published on 2025-08-03T08:15:24.290.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23472
Vulnerability details
A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unrestricted file upload vulnerability in /userregistration.php enables exploitation of a public-facing web application (T1190) to upload and execute web shells (T1100 for execution, T1505.003 for persistence), allowing remote code execution, command execution, file access, and system control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of all input (including the photo argument) to reject dangerous file types before they are stored.
Enforces access-control policy on the userregistration.php endpoint so only authorized actions and file types are permitted.
Deploys malicious-code protection mechanisms that scan or block uploaded files containing executable or dangerous content.