moga-mall CVE-2025-15152

Exploitation requires a valid low-privileged authenticated session (CVSS PR:L) on a moga-mall instance, after which the attacker sends a request to the addProduct function in src/main/java/com/ms/product/controller/PmsProductController.java with a manipulated objectName parameter to perform an unrestricted file upload. The key limiting factor is that authentication is required - this is not a pre-auth flaw despite the 'Authentication Bypass' tag - and the assessed impact is Low across C/I/A, so it does not inherently yield arbitrary code execution. The absence of released version identifiers (rolling-release model) makes it hard to scope which deployments are affected.

This is a moderate, not high-priority, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and 5.3 score indicate a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L), and the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) rather than High - meaning VulDB assessed this as a limited-impact unrestricted upload, not a full remote-code-execution file upload. No EPSS score was provided in the input and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation. A public write-up/exploit reference exists on GitHub (the Chinese-language '任意文件上传'/arbitrary-file-upload markdown), indicating publicly available exploit material. Signals are internally consistent: a low-privilege authenticated remote flaw in a small open-source Java project with a POC but no confirmed in-the-wild use. One tension worth noting: the 'Authentication Bypass' tag conflicts with the PR:L vector, which assumes the attacker already holds valid low-privilege credentials rather than bypassing authentication - verify against the actual advisory before treating this as a pre-auth bug.

An attacker with a low-privileged authenticated account on a moga-mall deployment invokes the addProduct endpoint in PmsProductController and manipulates the objectName argument to upload a file to an unintended location or of an unintended type. A public write-up describing arbitrary file upload exists on GitHub, lowering the effort to reproduce. Because CVSS impacts are rated Low across confidentiality, integrity, and availability, the realistic outcome is limited unauthorized file placement rather than guaranteed server takeover.