Vulnerability · Published Feb 7, 2025 · Assigned by VulDB
CVE-2025-1113taisan tarzan-cms Add Theme admin#themes upload deserialization
Medium 6.3
In plain English
A medium-severity unsafe deserialization in tarzan-cms from taisan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 55.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| taisan | tarzan-cms | 1.0 |
Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-295019 | taisan tarzan-cms Add Theme admin#themes upload deserialization vdb-entry, technical-description
- VDB-295019 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- https://gitee.com/taisan/tarzan-cms/issues/IBHZ0J exploit, issue-tracking