CVE-2025-2195 in MRCMS
Summary
by MITRE • 03/11/2025
A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument name/path leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/23/2026
This vulnerability resides within MRCMS version 3.1.2, specifically targeting the FileController component's rename functionality. The issue manifests in the /admin/file/rename.do endpoint where the name/path parameter is not properly sanitized or validated before being processed. This cross site scripting flaw allows attackers to inject malicious scripts into the application's response, potentially compromising user sessions and enabling unauthorized access to administrative functions. The vulnerability affects the core file management capabilities of the content management system, making it particularly dangerous as it could enable attackers to manipulate or delete critical files within the system's file structure. The remote exploitation capability means that threat actors can leverage this vulnerability without requiring physical access to the target network, significantly expanding the attack surface.
The technical implementation flaw stems from inadequate input validation and output encoding practices within the FileController class. When users attempt to rename files through the administrative interface, the application fails to properly escape or filter user-supplied path names before incorporating them into the web response. This vulnerability aligns with CWE-79, which specifically addresses cross site scripting flaws in web applications, where inadequate sanitization of user input allows malicious code execution. The flaw represents a classic injection vulnerability that bypasses standard security controls and can be exploited through various attack vectors including URL manipulation, form submissions, or API calls targeting the vulnerable endpoint.
The operational impact of this vulnerability extends beyond simple script injection as it provides attackers with potential access to sensitive administrative functions within the MRCMS system. Successful exploitation could allow threat actors to escalate privileges, modify file permissions, or even gain full control over the content management infrastructure. The fact that this vulnerability has been publicly disclosed and is actively being used in the wild indicates that it represents a significant risk to organizations relying on this specific version of MRCMS, particularly those with exposed administrative interfaces. Organizations may experience data breaches, service disruption, or complete system compromise if proper mitigations are not implemented immediately.
Security professionals should implement multiple layers of protection including input validation at the application level, output encoding for all user-supplied content, and regular security updates to address known vulnerabilities in third-party components. The recommended mitigation strategy involves immediate patching of the MRCMS software to a version that addresses this specific vulnerability, combined with web application firewall rules that can detect and block malicious payload patterns targeting the rename endpoint. Additionally, organizations should conduct comprehensive penetration testing to identify any other potentially vulnerable endpoints within the system, as this vulnerability may indicate broader security issues in the application's architecture. The ATT&CK framework categorizes this type of vulnerability under T1213 - Data from Information Repositories, as it enables unauthorized access to stored data through compromised administrative functions. Organizations should also consider implementing least privilege access controls and monitoring for unusual file manipulation activities that might indicate exploitation attempts.