File Manager Vulnerability in Innoshop Affecting Admin Panel

CVE-2025-52921

What is CVE-2025-52921?

In versions of Innoshop through 0.4.1, a security flaw exists in the file management functionality of the admin panel. Authenticated attackers can exploit this vulnerability by uploading a malicious file and subsequently renaming it to a .php extension. This process circumvents existing frontend checks that are intended to restrict file type changes. The attacker's ability to utilize proxy tools, like BurpSuite, allows for the bypassing of security measures that should prevent this action. Once the crafted file is renamed, it can be executed on the server via a simple GET request, leading to potential server compromise.

References