CVE-2025-4333: feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java uploadFile unrestricted upload
First published: Tue May 06 2025(Updated: )
A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFile of the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the argument uploadFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ssm-erp | <0.0.1 | |
| ssm-erp | <0.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4333?
CVE-2025-4333 has been classified as a critical vulnerability.
Which versions are affected by CVE-2025-4333?
CVE-2025-4333 affects versions up to but not including 0.0.1 of feng_ha_ha/megagao ssm-erp and production_ssm.
How do I fix CVE-2025-4333?
To fix CVE-2025-4333, upgrade to a version higher than 0.0.1 of the affected software.
What functionality is impacted by CVE-2025-4333?
The CVE-2025-4333 vulnerability impacts the uploadFile function in the FileServiceImpl.java file.
What is the potential risk of exploiting CVE-2025-4333?
Exploiting CVE-2025-4333 could allow an attacker to manipulate file uploads, potentially leading to unauthorized access or data breaches.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/feng_ha_ha
- canonical/ssm-erp