InnoShop up to 0.4.1 File Manager Rename unprotected alternate channel

Summaryinfo

A vulnerability was found in InnoShop up to 0.4.1. It has been classified as problematic. Affected by this issue is the function Rename of the component File Manager. This manipulation causes unprotected alternate channel. This vulnerability appears as CVE-2025-52921. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in InnoShop up to 0.4.1. Affected by this vulnerability is the function Rename of the component File Manager. The manipulation with an unknown input leads to a unprotected alternate channel vulnerability. The CWE definition for the vulnerability is CWE-420. The product protects a primary channel, but it does not use the same level of protection for an alternate channel. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-52921 since 06/21/2025. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18868). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• InnoShop

Version

• 0.4.0
• 0.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion