CVE-2025-5130 Details

A critical arbitrary file upload vulnerability has been identified in Tmall Demo versions prior to 20250505. The issue resides in the 'uploadProductImage' function within 'tmall/admin/uploadProductImage'. This vulnerability allows remote attackers to upload malicious files, such as web shells, viruses, and scripts, potentially leading to server control or sensitive information theft. The vulnerability arises from a lack of file content and name validation, enabling unrestricted file uploads. Exploitation is possible by uploading a JSP file containing executable code, which can then be accessed and executed on the server.

Implement strict file type restrictions on uploads, allowing only specific formats such as images or documents. Validate file headers to ensure compliance with allowed types. Restrict execution permissions on upload directories to prevent script execution. Rename uploaded files to random names to avoid predictable paths and scan files for malicious content before processing.