CVE-2025-15499
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangfor | operation_and_maintenance_management_system | to 3.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15499 is a command injection vulnerability in Sangfor Operation and Maintenance Management System version 3.0.8. It occurs in the uploadCN function of VersionController.java, where the filename parameter in a file upload request is not properly sanitized. Although some filesystem characters are filtered, dangerous shell metacharacters like ;, |, and & are not neutralized. This allows an attacker to inject arbitrary OS commands that get executed with the application's privileges, which are often root or tomcat. The vulnerability can be exploited remotely by sending a specially crafted filename in a multipart/form-data upload request. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary system commands on the affected server with the privileges of the application process. This can lead to full system compromise, including unauthorized access, data theft, data modification, service disruption, or further attacks within the network. Since the application often runs with high privileges (root or tomcat), the impact is severe and can compromise confidentiality, integrity, and availability of the system. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the /system/version/upload_CN endpoint with multipart/form-data uploads containing filenames with shell metacharacters such as ;, |, and &. A proof-of-concept involves sending a POST request with a filename like "a.txt;whoami>bc.txt;1.txt" (25 characters) to inject commands. You can detect exploitation attempts by checking for such unusual filenames or by looking for unexpected files like bc.txt created in the upload directory. Network monitoring tools or web application firewalls can be configured to alert on such patterns. Example detection commands include using curl to simulate the exploit: curl -X POST -F "filename='a.txt;whoami>bc.txt;1.txt'" http://target/system/version/upload_CN and then checking for the output file bc.txt on the server or monitoring logs for command execution attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Implement strict whitelist validation on the filename parameter, allowing only alphanumeric characters and dots to prevent shell metacharacters. 2) Avoid executing shell commands with concatenated strings; instead, use Java's native file handling APIs or ProcessBuilder with argument lists to safely handle inputs. 3) Monitor and block suspicious upload requests containing shell metacharacters. 4) If possible, consider replacing the affected product as no official vendor patch or mitigation has been provided. 5) Restrict privileges of the application process to minimize impact if exploited. [3, 2]