CVE-2025-7065
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-11-26
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| widzialni | pad_cms | to 1.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in PAD CMS's photo upload functionality, where a client-controlled permission check parameter allows an unauthenticated remote attacker to upload files of any type and extension without restriction. These uploaded files can then be executed, leading to Remote Code Execution on the affected system. The issue affects all three templates: www, bip, and ww+bip.
How can this vulnerability impact me? :
The vulnerability can lead to Remote Code Execution by an unauthenticated attacker, which means an attacker can run arbitrary code on the affected system. This can result in full system compromise, data theft, service disruption, or further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
Since the product is End-Of-Life and no patches will be published, immediate mitigation steps include disabling or restricting access to the photo upload functionality to prevent unauthenticated file uploads, implementing network-level controls such as firewalls or web application firewalls (WAF) to block malicious requests, and considering removing or replacing the vulnerable PAD CMS installation with a supported alternative.