CVE-2025-65657

{
  "id": "CVE-2025-65657",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-02T21:15:53.063",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE)."
    },
    {
      "lang": "es",
      "value": "FeehiCMS versión 2.1.1 tiene una Ejecución Remota de Código a través de Carga de Archivos Sin Restricciones en Gestión de Anuncios. FeehiCMS versión 2.1.1 permite a atacantes remotos autenticados cargar archivos que el servidor ejecuta posteriormente (o almacena en una ubicación ejecutable) sin suficiente validación, saneamiento o restricciones de ejecución. Un atacante remoto autenticado puede cargar un archivo PHP manipulado y hacer que la aplicación o el servidor web lo ejecute, lo que resulta en ejecución remota de código (RCE)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-02T21:56:54.206745Z",
          "id": "CVE-2025-65657",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:feehi:feehicms:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBEE4749-21CC-4336-8565-A05BC680EDF2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/liufee/cms/issues/78",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}