CVE-2025-52921 | In Innoshop through 0.4.1, an authenticated attacker could e… | CVSS 9.9 CRITICAL

Description

In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.

Metadata

CVE ID: CVE-2025-52921
State: PUBLISHED
Assigner: mitre
Reserved: 2025-06-21 00:00 UTC
Published: 2025-06-23 00:00 UTC
Last updated: 2025-06-23 13:51 UTC
Primary CWE: CWE-420
CWE-420 Unprotected Alternate Channel
Vendor / Product: InnoShop / InnoShop
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
InnoShop	InnoShop	—	0 ≤ 0.4.1

Weakness (CWE)

CWE	Source	Description
CWE-420	cna	CWE-420 Unprotected Alternate Channel

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References (2)