PT-2025-19928 · Unknown · Megagao Ssm-Erp+1

Fatd0G + 1 · Published 2025-05-06 · Updated 2025-05-06 · CVE-2025-4333

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions feng ha ha/megagao ssm-erp and production ssm version 0.0.1

Description A critical issue affects the uploadFile function in the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the uploadFile argument allows for unrestricted file upload. This issue can be exploited remotely.

Recommendations For version 0.0.1, consider disabling the uploadFile function until a patch is available to prevent unrestricted file uploads. Restrict access to the FileServiceImpl.java service to minimize the risk of exploitation. Avoid using the uploadFile argument in the affected service until the issue is resolved.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-4333

Affected Products

Megagao Ssm-Erp

Production Ssm

References · 6

• 🔥 https://github.com/Hao-Ni/CVE/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4333 · Security Note
• https://vuldb.com/?submit.564591 · Note
• https://vuldb.com/?id.307437 · Note
• https://twitter.com/CVEnew/status/1919668738011570275 · Twitter Post
• https://vuldb.com/?ctiid.307437 · Note