PT-2025-10904 · Unknown · Aitangbao Springboot-Manager

Uglory · Published 2025-03-11 · Updated 2025-03-12 · CVE-2025-2208

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: aitangbao springboot-manager version 3.0

Description: A problematic issue has been found in the Filename Handler component, affecting the processing of the file /sysFiles/upload. The manipulation of the name argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations: For aitangbao springboot-manager version 3.0, as a temporary workaround, consider restricting access to the /sysFiles/upload file and the Filename Handler component to minimize the risk of exploitation. Avoid using the name argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-2208

Affected Products

Aitangbao Springboot-Manager

References · 7

• 🔥 https://github.com/uglory-gll/javasec/blob/main/spring-manage.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2208 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2208 · Vendor Advisory
• https://vuldb.com/?submit.511738 · Note
• https://vuldb.com/?id.299279 · Note
• https://twitter.com/CVEnew/status/1899713971160002836 · Twitter Post
• https://vuldb.com/?ctiid.299279 · Note