PT-2025-34578 · Unknown · Yifang Cms

Yu Bao · CVE-2025-9400 · Published 2025-08-25 · Updated 2025-12-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: YiFang CMS versions through 2.0.5

Description: A flaw exists in YiFang CMS up to version 2.0.5, specifically within the mergeMultipartUpload function located in the app/utils/base/plugin/P file.php file. Manipulation of the File argument leads to unrestricted file upload. Remote exploitation is possible. The exploit has been published and may be used. The vendor was contacted prior to disclosure but did not respond.

Recommendations: Update YiFang CMS to a version beyond 2.0.5. As a temporary workaround, restrict access to the P file.php file.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-9400

Affected Products

Yifang Cms

References · 10

• 🔥 https://github.com/August829/Yu/blob/main/20250811_3.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9400 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9400 · Vendor Advisory
• https://vuldb.com/?submit.632535 · Note
• https://vuldb.com/?ctiid.321236 · Note
• https://t.me/cveNotify/145492 · Telegram Post
• https://github.com/August829/Yu/blob/main/20250811_3.md · Note
• https://twitter.com/dailycve/status/1999236393919234199 · Twitter Post
• https://t.me/CVEtracker/30813 · Telegram Post
• https://vuldb.com/?id.321236 · Note