PT-2025-54229 · Unknown · Newbee-Mall-Plus

Zyhsec · Published 2025-12-30 · Updated 2025-12-30 · CVE-2025-15360

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions newbee-mall-plus version 2.0.0

Description A flaw exists in newbee-mall-plus version 2.0.0 that allows for unrestricted file uploads. This issue is located within the Upload function of the src/main/java/ltd/newbee/mall/controller/common/UploadController.java file, specifically affecting the Product Information Edit Page component. The vulnerability is triggered by manipulating the File argument, enabling remote attackers to upload files without restrictions. The details of this issue have been publicly disclosed. The vendor was informed of this disclosure but did not provide a response.

Recommendations Apply a fix to the Upload function in src/main/java/ltd/newbee/mall/controller/common/UploadController.java to restrict file upload types and sizes.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-15360

Affected Products

Newbee-Mall-Plus

References · 7

• 🔥 https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15360 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15360 · Vendor Advisory
• https://vuldb.com/?submit.716785 · Note
• https://vuldb.com/?ctiid.338744 · Note
• https://twitter.com/CVEnew/status/2006132891864965148 · Twitter Post
• https://vuldb.com/?id.338744 · Note