CVE Details
Basic Information
| Title |
Tmall Demo uploadProductImage unrestricted upload |
| Type |
cve |
| Published |
2025-05-24T20:00:10.664Z |
| Last Seen |
|
Product Information
| Vendor |
Tmall |
| Product |
Demo |
| Version |
20250505 |
CVSS Information
| Base Score |
0.0 () |
| Attack Vector |
|
| Attack Complexity |
|
| Privileges Required |
|
| User Interaction |
|
| Scope |
|
| Confidentiality Impact |
|
| Integrity Impact |
|
| Availability Impact |
|
AI Analysis
| AI Description |
Tmall Demo is vulnerable to an unrestricted file upload in the uploadProductImage function, allowing attackers to upload malicious files remotely. The vulnerability is critical and affects all versions up to 20250505. The vendor has not responded to the disclosure. |
| AI Severity |
Medium |
| Vendor |
Tmall |
| Product |
Tmall Demo |
| Affected Version |
Up to 20250505 |
Additional Information
| CVE List |
|
| CWE List |
CWE-434, CWE-284 |
| Bulletin Family |
|
| Source Data |
Tmall Demo 20250505 |
Description
A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admin/uploadProductImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score Summary
View Full CVE Details
