CVE-2025-34121 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.

Reserved 2025-04-15 | Published 2025-07-16 | Updated 2025-07-16 | Assigner VulnCheck

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

CWE-306 Missing Authentication for Critical Function

Product status

Default status

unaffected

*

affected

Credits

Denis Andzakovic of Security-Assessment.com finder

References

raw.githubusercontent.com/...ti/http/uptime_file_upload_1.rb exploit

web.archive.org/...y/Up.Time 7.2 - Arbitrary File Upload.pdf third-party-advisory exploit

www.exploit-db.com/exploits/38732 exploit

www.vulncheck.com/.../idera-uptime-arbitrary-file-upload-rce third-party-advisory

cve.org (CVE-2025-34121)

nvd.nist.gov (CVE-2025-34121)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-34121

Support options

Helpdesk Chat, Email, Knowledgebase