Csweb CVE-2025-60947

This vulnerability presents high real-world risk due to multiple converging factors. The CVSS score of 8.8 reflects network-based exploitation with low attack complexity, requiring only low-level privileges and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. The existence of a public proof-of-concept exploit on GitHub dramatically lowers the barrier to exploitation, making this vulnerability accessible to less sophisticated attackers. The reporting by CISA's Cybersecurity and Infrastructure Security Agency (cisa-cg) through their CSAF advisory (va-26-082-01.json) suggests government concern about potential exploitation of critical infrastructure or public sector deployments. File upload vulnerabilities leading to RCE are highly automatable and frequently targeted in opportunistic scanning campaigns. Organizations running Census CSWeb 8.0.1 or earlier should treat this as a critical patching priority, especially given the authenticated access requirement may be satisfied through default credentials, compromised accounts, or low-privilege user roles.

An attacker with low-privilege authenticated access to a Census CSWeb 8.0.1 instance navigates to the file upload functionality, which may be available through data management or content administration interfaces. Using the publicly available proof-of-concept from https://github.com/hx381/cspro-exploits, the attacker crafts a malicious PHP web shell or other executable payload and uploads it, bypassing insufficient validation controls. Once uploaded, the attacker accesses the file directly through the web server, executing arbitrary code with the privileges of the web application, allowing full system compromise including data exfiltration, persistent backdoor installation, and lateral movement to connected systems.