PT-2025-19328 · Unknown · Newbee-Mall

1098024193 · Published 2025-05-05 · Updated 2025-05-05 · CVE-2025-4259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions newbee-mall version 1.0

Description A critical vulnerability has been found in the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely.

Recommendations As a temporary workaround, consider disabling the Upload function in the UploadController.java file until a patch is available. Restrict access to the UploadController.java file to minimize the risk of exploitation. Avoid using the File argument in the Upload function until the issue is resolved.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-4259

Affected Products

Newbee-Mall

References · 9

• 🔥 https://github.com/yaklang/IRifyScanResult/blob/main/newbee-mall/arbitrary-file-upload-in-uploadController.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-4259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4259 · Security Note
• https://vuldb.com/?id.307363 · Note
• https://t.me/cvetracker/23024 · Telegram Post
• https://t.me/cvedetector/24431 · Telegram Post
• https://twitter.com/CVEnew/status/1919235918440849755 · Twitter Post
• https://vuldb.com/?submit.562865 · Note
• https://vuldb.com/?ctiid.307363 · Note