Vulnerability · Published Feb 25, 2025 · Assigned by VulDB
CVE-2025-1676hzmanyun Education and Training System pdf2swf os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in Education and Training System from hzmanyun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)2.4%top 15.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hzmanyun | Education and Training System | 3.1.1 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-296731 | hzmanyun Education and Training System pdf2swf os command injection vdb-entry, technical-description
- VDB-296731 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #500507 | hzmanyun education and training system v3.1.1 RCE third-party-advisory
- https://github.com/Rain1er/report/blob/main/nxb/rce1.md exploit