PT-2025-23405 · Unknown · Xueshengzhusu

Eurekya · Published 2025-05-31 · Updated 2025-05-31 · CVE-2025-5380

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb

Description A critical issue has been found in the Image File Upload component of the system, affecting some unknown processing of the file /upload/. The manipulation of the File argument leads to path traversal. The attack may be initiated remotely.

Recommendations As a temporary workaround, consider disabling the Image File Upload component until a patch is available. Restrict access to the /upload/ directory to minimize the risk of exploitation. Avoid using the File argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-5380

Affected Products

Xueshengzhusu

References · 8

• 🔥 https://gitee.com/ashinigit/XueShengZhuSu/issues/IC9VZD · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5380 · Security Note
• https://t.me/cvetracker/25086 · Telegram Post
• https://vuldb.com/?submit.583119 · Note
• https://t.me/cvenotify/124246 · Telegram Post
• https://vuldb.com/?id.310673 · Note
• https://twitter.com/CVEnew/status/1928817285453492262 · Twitter Post
• https://vuldb.com/?ctiid.310673 · Note