Muzuro Ecommerce System CVE-2025-12291

Q: What is the CVSS score of CVE-2025-12291?

CVE-2025-12291 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-10-27 cna@vuldb.com

PHP Authentication Bypass File Upload

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:36 vuln.today

DescriptionCVE.org

A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product of the component Add Product Page. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload vulnerability in Muzuro Ecommerce System and ashymuzuro Full-Ecommerce-Website up to version 1.1.0 allows remote authenticated high-privilege administrators to upload arbitrary files via the Add Product Page (/admin/index.php?add_product), with exploit code publicly disclosed. Despite low CVSS score (2.0) due to high privilege requirement, the vulnerability enables direct code execution risk in admin-controlled uploads and received no vendor response to disclosure.

Technical ContextAI

The vulnerability exists in the Add Product Page component of the Muzuro Ecommerce System, specifically the /admin/index.php?add_product endpoint. CWE-284 (Improper Access Control) indicates the root cause is insufficient validation of file uploads at the application layer. The affected product is a PHP-based e-commerce platform; the file upload mechanism lacks proper type, extension, or content validation, allowing malicious files to be stored server-side. This is a common PHP application weakness where user-supplied file data is written to disk without sanitization or verification.

Affected ProductsAI

ashymuzuro Full-Ecommerce-Website and Muzuro Ecommerce System versions up to and including 1.1.0 are affected. The specific vulnerable component is the Add Product Page accessible at /admin/index.php?add_product. No CPE string was provided in the source data. No vendor advisory or patch acknowledgment is available.

RemediationAI

No vendor-released patch has been identified at time of analysis due to vendor non-responsiveness. Immediate workarounds include: (1) disable or restrict access to the Add Product feature in /admin/index.php?add_product to trusted administrators only via network-level access controls (e.g., IP whitelisting, VPN requirement); (2) implement server-side file upload validation that checks MIME type, file extension against a strict whitelist (images only, no PHP/executable), and scans uploaded content; (3) configure the web server to disable PHP execution in the upload directory using .htaccess or web server configuration (.php files in upload folder will not execute); (4) upgrade to a newer version of Muzuro Ecommerce System if available from the vendor or switch to a maintained e-commerce platform. Each mitigation has trade-offs: access controls reduce usability for legitimate admins, extension whitelisting may block legitimate file types, and disabling PHP execution in uploads prevents dynamic content but adds complexity.