Document Management System CVE-2025-8171

Exploitation requires valid authentication credentials (PR:L in CVSS vector confirms authenticated access is mandatory). The attacker must have access to the upload functionality, typically restricted to registered users or document managers. No special system configuration is explicitly required beyond a standard PHP-based deployment of Document Management System 1.0. The vulnerability does NOT affect unauthenticated visitors. Exploitation is limited by the default file upload permissions and server-side execution policy; if the upload directory has PHP execution disabled by the administrator, file upload alone will not achieve code execution.

CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible vulnerability requiring low complexity but authenticated access (PR:L), with limited confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). EPSS 0.06% (17th percentile) signals very low exploitation probability despite public POC availability, suggesting the vulnerability requires specific deployment conditions or low practical incentive for attackers. The authenticated prerequisite significantly reduces real-world risk compared to unauthenticated file upload flaws. Discrepancy noted: CVE description classifies as 'critical' but CVSS score 2.1 and EPSS 0.06% indicate low priority - this classification mismatch suggests the reporter may have misunderstood severity ratings; actual risk appears limited to authenticated users with upload privileges in relatively isolated document management instances.

An authenticated user with document upload privileges crafts a POST request to /insert.php with a malicious PHP shell disguised as a document by manipulating the uploaded_file parameter to contain executable code. The server accepts and stores the PHP file in a web-accessible directory. The attacker accesses the uploaded PHP file via HTTP, triggering code execution on the server with the privileges of the web application user, enabling full system compromise or lateral movement.