CVE-2025-15360
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to newbee-mall-plus 2.0.0 through the product information edit page. Attackers can exploit this to upload malicious files like web shells, potentially leading to server compromise. Any system running the vulnerable version with the upload functionality accessible is affected.
💻 Affected Systems
- newbee-mall-plus
📦 What is this software?
Newbee Mall Plus by Newbee Ltd
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover via web shell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Web shell upload enabling persistent backdoor access, data exfiltration, or lateral movement
If Mitigated
File uploads restricted to authorized users only with proper validation, limiting impact
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; vendor unresponsive to disclosure
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and file type restrictions in UploadController.java
🔧 Temporary Workarounds
Implement file upload validation
allAdd server-side validation to restrict file types, extensions, and content
Modify src/main/java/ltd/newbee/mall/controller/common/UploadController.java to validate file types, extensions, and MIME types
Disable upload functionality
allTemporarily disable the vulnerable upload endpoint
Comment out or remove upload mapping in UploadController.java
Add @RequestMapping restriction to limit access
🧯 If You Can't Patch
- Implement WAF rules to block suspicious file uploads and known exploit patterns
- Restrict network access to the upload endpoint using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if running newbee-mall-plus 2.0.0 and test file upload with restricted extensions like .jsp, .php, .exeCheck Version:
Check pom.xml or application properties for version informationVerify Fix Applied:
Test upload functionality with malicious file types to ensure they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with suspicious extensions
- Multiple failed upload attempts
- Uploads from unexpected IP addresses
Network Indicators:
- HTTP POST requests to upload endpoints with unusual file types
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_server" AND (uri="/upload" OR uri CONTAINS "upload") AND (file_extension IN ("jsp", "php", "exe", "war"))🔗 References
- https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
- https://vuldb.com/?ctiid.338744
- https://vuldb.com/?id.338744
- https://vuldb.com/?submit.716785
- https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
