CVE-2025-14522
BaseFortify
Publication date: 2025-12-11
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| baowzh | hfly | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the baowzh hfly software, specifically in an unknown function within the file /Public/Kindeditor/php/upload_json.php. It involves manipulation of the argument 'imgFile' which allows an attacker to perform an unrestricted file upload. This means an attacker can remotely upload files without proper restrictions, potentially leading to unauthorized actions on the system.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to upload files without restriction, which can lead to unauthorized access, execution of malicious code, or compromise of the affected system. This can result in data breaches, system downtime, or further exploitation by attackers.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for the presence of the vulnerable upload endpoint `/Public/Kindeditor/php/upload_json.php` on your web server. You can use Google dorking with the query `inurl:Public/Kindeditor/php/upload_json.php` to find potentially vulnerable targets. Additionally, monitoring HTTP requests for attempts to upload files via the `imgFile` parameter to this endpoint may help detect exploitation attempts. Specific commands are not provided, but using tools like curl or wget to test file upload functionality on this endpoint, or scanning with web vulnerability scanners targeting unrestricted file upload vulnerabilities, can be effective. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for the presence of the vulnerable upload endpoint `/Public/Kindeditor/php/upload_json.php` on your web servers. One suggested method is using Google dorking with the query `inurl:Public/Kindeditor/php/upload_json.php` to identify potentially vulnerable targets. Additionally, monitoring HTTP requests for attempts to manipulate the `imgFile` parameter to upload files can help detect exploitation attempts. Specific commands are not provided, but you can use web server access logs or intrusion detection systems to filter for requests containing `imgFile` uploads to this path. [1]
What immediate steps should I take to mitigate this vulnerability?
There are no known mitigations or countermeasures available for this vulnerability. The recommended immediate step is to replace the affected component or product with an alternative that does not contain this vulnerability. Since the vendor has not provided a patch or response, discontinuing use of the vulnerable software is advised to prevent exploitation. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the vulnerable upload endpoint `/Public/Kindeditor/php/upload_json.php` to prevent exploitation. Since no known patches or mitigations exist due to the rolling release model and lack of vendor response, it is recommended to replace the affected component with an alternative product that does not have this vulnerability. Additionally, implementing strict file upload validation and filtering on the server side, if possible, can reduce risk. Monitoring for exploitation attempts and applying network-level protections such as web application firewalls may also help mitigate impact. [1]