by Kastro
Paper/Archive/CVE-2025-34121

CVE-2025-34121

Idera Up.Time Monitoring Station — Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE

EPSS 3%public exploitCVSS 9.3
critical.is priorityof 100
55
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 86.5.865 × 2017.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.

Affected

ProductAffectedFixed inSource
Up.Time Monitoring Station≤ 7.2–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/uptime_file_upload_1.rbexploitweb.archive.org/web/20150210113937/http://www.security-assessment.com/files/documents/advisory/Up.Time%207.2%20-%20Arbitrary%20File%20Upload.pdfexploitexploit-db.com/exploits/38732writeupvulncheck.com/advisories/idera-uptime-arbitrary-file-upload-rce