PT-2025-34699 · Greencms · Greencms

Ustc-L1Nk · Publicado 2025-08-25 · Atualizado 2025-12-31 · CVE-2025-9415

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GreenCMS versions prior to 2.3.0604

Description: A vulnerability exists in GreenCMS that allows for unrestricted file upload. The issue is located in an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. Manipulation of the upload[] argument enables the unrestricted upload of files. The attack can be carried out remotely. The exploit is publicly available. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations: Update GreenCMS to version 2.3.0604 or later.

Exploit

Correção

Improper Access Control

Unrestricted File Upload

Enumeração de Fraquezas

CWE-284

CWE-434

Identificadores relacionados

CVE-2025-9415

Produtos afetados

Greencms

Referências · 10

• 🔥 https://github.com/lan041221/cvec/issues/10 · Exploit
• https://vuldb.com/?ctiid.321258 · Nota
• https://osv.dev/vulnerability/CVE-2025-9415 · Aviso do Fabricante
• https://t.me/cveNotify/147350 · Publicação no Telegram
• https://vuldb.com/?submit.633847 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9415 · Nota de Segurança
• https://t.me/CVEtracker/30860 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1960122902600110244 · Publicação no Twitter
• https://vuldb.com/?id.321258 · Nota
• https://twitter.com/CVEnew/status/1960061383904514063 · Publicação no Twitter