PT-2025-16216 · Huanfenz/Code Projects · Studentmanager

77Cc · Published 2025-04-14 · Updated 2025-04-14 · CVE-2025-3565

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: huanfenz/code-projects StudentManager version 1.0

Description: A critical issue was found in the Announcement Management Section of the software, specifically affecting the /upload/uploadArticle.do file. The manipulation of the File argument leads to unrestricted upload. This issue can be exploited remotely.

Recommendations: For version 1.0, consider restricting access to the /upload/uploadArticle.do file to minimize the risk of exploitation. As a temporary workaround, avoid using the File argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-3565

Affected Products

Studentmanager

References · 10

• 🔥 https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-xss.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-3565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3565 · Security Note
• https://vuldb.com/?ctiid.304606 · Note
• https://vuldb.com/?submit.549316 · Note
• https://twitter.com/WolfgangSesin/status/1911599869078237245 · Twitter Post
• https://vuldb.com/?id.304606 · Note
• https://t.me/cvetracker/21530 · Telegram Post
• https://t.me/cvedetector/22849 · Telegram Post
• https://twitter.com/CVEnew/status/1911758401111220231 · Twitter Post