High severity · published Jan 24, 2025
CVE-2025-0702
JoeyBling bootplus SysFileController.java unrestricted upload
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument portraitFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bootplus · JoeyBling
247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0702
Not Applicable
https://github.com/JoeyBling/bootplus/issues/24
Not Applicable
https://github.com/JoeyBling/bootplus/issues/24#issue-2786919432
Permissions Required
https://vuldb.com/?ctiid.293230
Third Party Advisory
https://vuldb.com/?id.293230
Third Party Advisory
https://vuldb.com/?submit.480841
More from bootplus
8.8
CVE-2025-0701
JoeyBling bootplus list sql injection
8.8
CVE-2025-0700
JoeyBling bootplus list sql injection
8.8
CVE-2025-0699
JoeyBling bootplus list sql injection
8.8
CVE-2025-0698
JoeyBling bootplus list sql injection
6.1
CVE-2025-0705
JoeyBling bootplus QrCodeController.java qrCode redirect