PT-2025-34699 · Greencms · Greencms

Ustc-L1Nk · Published 2025-08-25 · Updated 2025-12-31 · CVE-2025-9415

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GreenCMS versions prior to 2.3.0604

Description: A vulnerability exists in GreenCMS that allows for unrestricted file upload. The issue is located in an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. Manipulation of the upload[] argument enables the unrestricted upload of files. The attack can be carried out remotely. The exploit is publicly available. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations: Update GreenCMS to version 2.3.0604 or later.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-9415

Affected Products

Greencms

References · 10

• 🔥 https://github.com/lan041221/cvec/issues/10 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9415 · Security Note
• https://vuldb.com/?ctiid.321258 · Note
• https://t.me/cveNotify/147350 · Telegram Post
• https://vuldb.com/?submit.633847 · Note
• https://t.me/CVEtracker/30860 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960122902600110244 · Twitter Post
• https://vuldb.com/?id.321258 · Note
• https://twitter.com/CVEnew/status/1960061383904514063 · Twitter Post