PT-2025-43975 · Unknown · Ashymuzuro Full-Ecommece-Website+1

Lianhaorui · Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-12291

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System versions up to 1.1.0

Description A flaw exists in the Add Product Page component of the software, specifically affecting the file /admin/index.php?add product. This allows for unrestricted file upload, potentially enabling remote attacks. The exploit has been publicly released, and the vendor was notified but did not respond.

Recommendations Versions prior to 1.1.0 should be updated. As a temporary workaround, restrict access to the /admin/index.php?add product endpoint.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-12291

Affected Products

Muzuro Ecommerce System

Ashymuzuro Full-Ecommece-Website

References · 8

• 🔥 https://github.com/Lianhaorui/Report/blob/main/FileUpload-1.docx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12291 · Security Note
• https://vuldb.com/?submit.675846 · Note
• https://vuldb.com/?id.329959 · Note
• https://vuldb.com/?ctiid.329959 · Note
• https://t.me/CVEtracker/35850 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1982962170817118582 · Twitter Post
• https://twitter.com/CVEnew/status/1982837420522451188 · Twitter Post