CVE-2025-52130
BaseFortify
Publication date: 2025-08-25
Last updated on: 2025-08-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smewebify | weberpmesv2 | 1.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-616 | The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a file upload flaw in WebErpMesv2 version 1.17, specifically in the FactoryController.php file. It allows an authenticated attacker to upload arbitrary files, including malicious PHP scripts, which can then be accessed directly via GET requests. This can lead to remote code execution on the web server.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with authentication to upload and execute arbitrary code on the web server, potentially leading to full compromise of the server, unauthorized access to data, disruption of services, and further attacks within the network.