Description

A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFile of the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the argument uploadFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names. Es wurde eine Schwachstelle in feng_ha_ha/megagao ssm-erp and production_ssm bis 0.0.1 ausgemacht. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion uploadFile der Datei src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. Durch das Beeinflussen des Arguments uploadFile mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.

Classification

CVE ID: CVE-2025-4333

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.3

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Products

Vendor: feng_ha_ha, megagao

Product: ssm-erp, production_ssm

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 10.4% (scored less or equal to compared to others)

EPSS Date: 2025-06-04 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4333
https://vuldb.com/?id.307437
https://vuldb.com/?ctiid.307437
https://vuldb.com/?submit.564591
https://github.com/Hao-Ni/CVE/issues/1

Timeline