CVE-2025-34121
BaseFortify
Publication date: 2025-07-16
Last updated on: 2025-07-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| idera | up.time | 7.2 |
| idera | up.time | 7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unauthenticated arbitrary file upload issue in Idera Up.Time Monitoring Station versions up to and including 7.2. The vulnerability exists in the wizards/post2file.php script, which accepts arbitrary POST parameters. Attackers can exploit this to upload crafted PHP files to the webroot, leading to remote code execution with the privileges of the web server user.
How can this vulnerability impact me? :
Exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected system as the web server user. This can lead to full system compromise, unauthorized access, data theft, service disruption, and further attacks within the network.