« Volver al listado

CVE-2025-52921

Estado: AplazadaCrítica (9.9)—

In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Atacante autenticado (PR:L) explota File Manager remoto para cargar y renombrar archivo a .php, ejecutando código en servidor. AV:N + PR:L → T1210. Impactos: ejecución de código PHP (T1059) y manipulación de datos mediante webshell (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory Permissions

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Innoshop — InnoshopAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-52921",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-52921",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-23T13:51:39.170467Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "InnoShop",
          "product": "InnoShop",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "0.4.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-23T12:15:22.970",
  "references": [
    {
      "url": "https://github.com/innocommerce/innoshop",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-420"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server."
    },
    {
      "lang": "es",
      "value": "En Innoshop hasta la versión 0.4.1, un atacante autenticado podía explotar las funciones del Administrador de Archivos del panel de administración para ejecutar código en el servidor. Para ello, subía un archivo manipulado y lo renombraba con la extensión .php mediante la función Renombrar. Esto evita la comprobación inicial de que los archivos subidos son imágenes. La aplicación utiliza comprobaciones del frontend para impedir que el administrador cambie la extensión de los archivos subidos a .php. Esta restricción se puede eludir fácilmente con cualquier herramienta proxy (p. ej., BurpSuite). Una vez que el atacante renombra el archivo y le asigna la extensión .php, se puede usar una solicitud GET para activar la ejecución de código en el servidor."
    }
  ],
  "lastModified": "2026-06-17T09:37:17.027",
  "sourceIdentifier": "cve@mitre.org"
}