PT-2025-34700 · Unknown · Weberpmesv2

The_Hiker · Published 2025-08-25 · Updated 2026-01-21 · CVE-2025-52130

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WebErpMesv2 version 1.17

Description: A file upload vulnerability exists in the app/Http/Controllers/FactoryController.php controller. An authenticated attacker can upload arbitrary files, including PHP scripts. These files are accessible via direct GET requests, potentially leading to remote code execution (RCE) on the web server.

Recommendations: As a temporary workaround, restrict file uploads to authorized users only. Review and sanitize all uploaded files before processing them. Implement strict file type validation to prevent the upload of executable files. Consider disabling the file upload functionality if it is not essential for the application's operation.

Fix

RCE

Weakness Enumeration

CWE-616

Related Identifiers

CVE-2025-52130

Affected Products

Weberpmesv2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-52130 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52130 · Vendor Advisory
• https://github.com/SMEWebify/WebErpMesv2 · Note
• https://t.me/CVEtracker/30862 · Telegram Post
• https://twitter.com/CVEnew/status/1960067274896732308 · Twitter Post
• https://t.me/cveNotify/149442 · Telegram Post
• https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c · Note
• https://twitter.com/VulmonFeeds/status/1960117783737286974 · Twitter Post