CVE-2025-0399 StarSea99 starsea-mall uploadController.java UploadController unrestricted upload
Remote attackers can upload malicious files via the UploadController in starsea-mall, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0399?
CVE-2025-0399 is a medium-severity vulnerability in StarSea99 starsea-mall, published on 12 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-0399?
It affects 1 product.
Products include Starsea99 Starsea-Mall.
How do I fix CVE-2025-0399?
No fix has been published for CVE-2025-0399 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0399 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0399 exists.
Other vulnerabilities in StarSea99 starsea-mall
- CVE-2025-2089 StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control
- CVE-2025-2085 StarSea99 starsea-mall save cross site scripting
- CVE-2025-2086 StarSea99 starsea-mall update cross site scripting
- CVE-2025-2087 StarSea99 starsea-mall update cross site scripting
- CVE-2025-0400 StarSea99 starsea-mall update cross site scripting
Sources
Also known as GHSA-8p8q-g287-8m97.