CVE-2025-2607 MEDIUM

CVE-2025-2607: phplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted upload

Vendor Phplaozhang
Product LzCMS-LaoZhangBoKeXiTong
Weakness CWE-434 · Unrestricted file upload
Published March 21, 2025
Last update March 24, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 21, 2025 CVE published
March 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-39397 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) CVE-2019-25229 Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload CVE-2025-6422 Campcodes Online Recruitment Management System About Content Page ajax.php unrestricted upload CVE-2021-44159 4MOSAn GCB Doctor - Unrestricted Upload of File CVE-2025-6206 Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload