Vulnerability · Published Mar 4, 2025 · Assigned by VulDB
CVE-2025-1947hzmanyun Education and Training System UploadImageController.java scorm command injection
Medium 6.3
In plain English
A medium-severity command injection in Education and Training System from hzmanyun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)5.2%top 7.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageController.java. The manipulation of the argument param leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hzmanyun | Education and Training System | 2.1.3 |
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-298521 | hzmanyun Education and Training System UploadImageController.java scorm command injection vdb-entry, technical-description
- VDB-298521 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #506659 | hzmanyun.com education and training system v2.1.3 RCE third-party-advisory
- https://github.com/heiheixz/report/blob/main/nxb_2.md exploit