CVE-2025-8752
Published: 09 August 2025
Summary
CVE-2025-8752 is a high-severity Injection (CWE-74) vulnerability in Xuanshao Spring-Shiro-Training. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct command injection in public-facing web endpoint enables remote exploitation (T1190) and arbitrary command execution (T1059).
NVD Description
A vulnerability was found in wangzhixuan spring-shiro-training up to 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It has been declared as critical. This vulnerability affects unknown code of the file /role/add. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has…
more
been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
Deeper analysisAI
CVE-2025-8752 is a command injection vulnerability (CWE-74, CWE-77) found in the wangzhixuan spring-shiro-training project up to commit 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It affects unknown code in the /role/add file and has been rated critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The vulnerability enables remote attackers to inject commands through manipulation of inputs to this endpoint.
Unauthenticated remote attackers with network access can exploit the issue by targeting the /role/add functionality, achieving low impacts on confidentiality, integrity, and availability through arbitrary command execution on the affected system.
The project employs continuous delivery with rolling releases, so no specific details on affected or updated versions are available. Mitigation guidance is referenced in Gitee issues at https://gitee.com/wangzhixuan/spring-shiro-training/issues/ICP2ME and VulDB entries including https://vuldb.com/?ctiid.319246, https://vuldb.com/?id.319246, and https://vuldb.com/?submit.623679.
The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)