CVE-2025-52921
Quick assessment
Affected
InnoShop InnoShop
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InnoShop是InnoShop开源的一个基于 Laravel 11 的开源电子商务系统。 InnoShop 0.4.1及之前版本存在安全漏洞，该漏洞源于管理员面板文件管理器功能存在缺陷，可能导致代码执行。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-52921
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未保护的候选通道
Source: CVE Program / CVE List V5
Vulnerability Title
InnoShop 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
InnoShop是InnoShop开源的一个基于 Laravel 11 的开源电子商务系统。 InnoShop 0.4.1及之前版本存在安全漏洞，该漏洞源于管理员面板文件管理器功能存在缺陷，可能导致代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2025-52921
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 8965 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-52921
请登录查看更多情报信息。
Security Blog Posts for CVE-2025-52921 (1)
Other References for CVE-2025-52921 (1)
-
🔗 GitHub - innocommerce/innoshop: Innoshop is an Open Source eCommerce System based on Laravel 12, supporting multiple languages, multiple currencies, integrated with OpenAI, and featuring plugin mechanisms and theme template development for enhanced user experience and system extensibility. Read full article
Same Patch Batch · InnoShop · 2025-06-23 · 3 CVEs total
| CVE-2025-52922 | 7.4 HIGH | InnoShop 安全漏洞 |
| CVE-2025-52920 | 6.4 MEDIUM | InnoShop 安全漏洞 |
IV. Related Vulnerabilities
Same product: InnoShop
V. Comments for CVE-2025-52921
No comments yet