CVE-2025-15152
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to the moga-mall application by manipulating the objectName parameter in the addProduct function. This affects all deployments of h-moses moga-mall up to commit 392d631a5ef15962a9bddeeb9f1269b9085473fa. The rolling release system means specific version numbers aren't disclosed, but all instances before the fix are vulnerable.
💻 Affected Systems
- h-moses moga-mall
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via malicious file upload leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file upload leading to defacement, data exfiltration, or serving malicious content to users.
If Mitigated
Limited impact with proper file validation and restricted execution permissions.
🎯 Exploit Status
Public GitHub repository contains exploit details. Simple parameter manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit after 392d631a5ef15962a9bddeeb9f1269b9085473fa
Vendor Advisory: Not provided
Restart Required: Yes
Instructions:
1. Pull latest code from repository. 2. Verify commit is newer than 392d631a5ef15962a9bddeeb9f1269b9085473fa. 3. Rebuild and redeploy application. 4. Restart service.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing suspicious file extensions or patterns in objectName parameter
File Upload Restriction
linuxConfigure application server to restrict upload directories and file permissions
chmod 755 /path/to/uploads
chown www-data:www-data /path/to/uploads
🧯 If You Can't Patch
- Implement strict file type validation at the application layer
- Deploy WAF with rules blocking suspicious upload patterns
🔍 How to Verify
Check if Vulnerable:
Check if your deployment uses commit 392d631a5ef15962a9bddeeb9f1269b9085473fa or earlier via git logCheck Version:
git log --oneline -1Verify Fix Applied:
Confirm current commit is newer than 392d631a5ef15962a9bddeeb9f1269b9085473fa and test file upload restrictions📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /product/add endpoint
- Requests with suspicious file extensions in parameters
Network Indicators:
- POST requests to /product/add with unusual Content-Type or file names
SIEM Query:
source="application.log" AND "addProduct" AND ("objectName" CONTAINS ".jsp" OR "objectName" CONTAINS ".php" OR "objectName" CONTAINS ".exe")