PT-2025-14546 · Vipshop · Saturn

Published 2025-04-02 · Updated 2025-04-07 · CVE-2025-29085

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vipshop Saturn versions 3.5.1 and earlier

Description The issue allows a remote attacker to execute arbitrary code. This can be achieved via the "/console/dashboard/executorCount" API endpoint, specifically by manipulating the zkClusterKey component.

Recommendations For versions 3.5.1 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "/console/dashboard/executorCount" API endpoint until a patch is available. Avoid using the zkClusterKey component in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-29085

GHSA-49V8-P6MM-3PFJ

Affected Products

Saturn

References · 9

• 🔥 https://gist.github.com/Cafe-Tea/bcef0d7a2bdb5ec8e0d69de852fdc900 · Exploit
• https://osv.dev/vulnerability/GHSA-49v8-p6mm-3pfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29085 · Security Note
• https://github.com/vipshop/Saturn · Note
• https://t.me/cvedetector/21930 · Telegram Post
• https://t.me/cvetracker/20622 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1909335381654335741 · Twitter Post
• https://twitter.com/CVEnew/status/1907551274515706133 · Twitter Post
• https://twitter.com/cybercronai/status/1908471013827838092 · Twitter Post