CVE-2025-7879
BaseFortify
Publication date: 2025-07-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| metasoft | metacrm | to 6.4.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7879 is a critical vulnerability in Metasoft MetaCRM up to version 6.4.2, specifically in the mobileupload.jsp file. It allows attackers to upload arbitrary files without any restrictions by manipulating the 'file' argument. This unrestricted file upload flaw can be exploited remotely and enables attackers to potentially compromise the server and perform malicious actions. [1, 2]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to server compromise, allowing attackers to upload malicious files that may affect the confidentiality, integrity, and availability of the system. This can result in unauthorized access, data breaches, service disruption, or further exploitation of the affected environment. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint /mobile/mobileupload.jsp on your MetaCRM system. One method is to use web scanning or HTTP request tools to see if the endpoint is accessible and accepts file uploads without restrictions. Additionally, attackers may use Google dorking with queries like "inurl:mobileupload.jsp" to identify vulnerable targets. For local detection, you can use curl or wget commands to test the upload functionality, for example: curl -F "file=@testfile" http://target/mobile/mobileupload.jsp -v to observe if the upload is accepted without authentication or restrictions. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the /mobile/mobileupload.jsp endpoint to prevent unauthorized file uploads. Since no vendor patch or official mitigation is available, it is recommended to replace the affected component with an alternative product if possible. Additionally, implement network-level controls such as firewall rules to block access to the vulnerable interface and monitor for suspicious upload activity. Applying strict input validation and file upload restrictions, if feasible, can also help reduce risk. [2]