CVE-2025-69981: SQL Injection
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69981?
CVE-2025-69981 is classified as a high severity vulnerability due to the potential for unauthorized file uploads.
How does CVE-2025-69981 allow exploitation?
CVE-2025-69981 can be exploited by unauthenticated attackers to upload arbitrary files to the FUXA application.
What software versions are affected by CVE-2025-69981?
CVE-2025-69981 specifically affects FUXA version 1.2.7.
How can I mitigate the risk associated with CVE-2025-69981?
To mitigate the risk of CVE-2025-69981, it is recommended to implement authentication mechanisms for the `/api/upload` endpoint.
What are the consequences of exploiting CVE-2025-69981?
Exploiting CVE-2025-69981 can lead to overwriting critical system files, potentially compromising the entire application.