CVE-2025-5406: chaitak-gorai blogbook

csirt@kutim:~/threat-intel/cve/CVE-2025-5406

CVSS 8.8 · High EPSS 0,47%

Kerentanan Improper Access Control pada chaitak-gorai blogbook. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown function of the file /admin/posts.php?source=add_post. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD: 1 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
chaitak-gorai	blogbook	Semua versi hingga 2021-11-22

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20add_post%20post_image%20Param... exploit · advisory pihak ketiga
https://vuldb.com/?id.310746 advisory pihak ketiga · vdb entry
https://vuldb.com/?submit.583427 advisory pihak ketiga · vdb entry
https://vuldb.com/?ctiid.310746 permissions required · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.