Description
A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/common/common.jsp. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sangfor | Operation and Maintenance Management System | 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Sangfor OSM - Arbitrary File Upload http/cves/2025/CVE-2025-15503.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- VDB-340348 | Sangfor Operation and Maintenance Management System common.jsp unrestricted upload vdb-entry technical-description
- VDB-340348 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #727253 | Sangfor Operation and Maintenance Management System (OSM / 运维安全管理系统) 3.0.8 Unrestricted Upload third-party-advisory
- https://github.com/master-abc/cve/issues/13 issue-tracking
- https://github.com/master-abc/cve/issues/13#issue-3770623333 exploit issue-tracking