CVE-2025-2952 is a medium severity (CVSS 6.3) unrestricted file upload in Bluestar Micro Mall 1.0. The upload handler at /api/api.php?mod=upload&type=1 accepts a File argument it should not trust. I could not confirm a fixed version, so apply compensating controls and contact the vendor.
What's affected
The record lists Bluestar Micro Mall 1.0 as affected. The weak spot is the upload functionality at /api/api.php?mod=upload&type=1, through the File argument.
There is no fixed version in the record, and the references (a VulDB entry and a third party write up) were not retrievable when I checked. Treat the product as unpatched until the vendor says otherwise.
The record says the exploit was disclosed publicly and that the attack can be launched remotely. It does not report exploitation in the wild, and the CVE is not in the CISA KEV catalog. This is a sibling of CVE-2025-2951, which affects the same product.
How to check if you're exposed
Look at where the application writes uploaded files and what the web server does with them.
- Confirm that you run version 1.0 of the product.
- Search access logs for requests to the upload path, and list files in the upload directory that were created recently or have script extensions.
- Check whether the upload directory is inside the web root and whether the server will execute scripts from it.
If you find unexpected files in an upload directory, treat the host as possibly compromised and follow your incident process before cleaning up.
What to do now
- Find every instance of Micro Mall 1.0 and decide whether it must stay online.
- Ask the vendor for a fixed release. If there is none, plan a replacement.
- Block or restrict the upload endpoint at the web server or firewall if the feature is not needed.
- Configure the server so that nothing in the upload directory can be executed as a script, and store uploads outside the web root where possible.
- Review the upload directory for files you did not expect and keep a copy for investigation.
Why it matters
The record lists CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). In short, the application lets a remote user send a file and does not check enough about what the file is or where it ends up.
Upload bugs are serious because the file itself can become the attack. If a server stores a file in a place where it can be run, the uploaded content may run with the web server's rights. Defenses are layered: allow only the file types you need, check content and not only the name, rename files on save, keep them out of executable paths, and require authentication for the upload feature.
The medium score reflects the limits in the CVSS vector. Your own risk depends on whether the endpoint requires login and what the web server account can reach.
Quick check
What is the safest long term fix for upload features?
Allow a short list of file types, verify content, rename files on save, store them outside the web root, and make sure the server never executes anything from the upload directory.
Is a patch available?
I could not confirm one. Ask the vendor and check the advisory references before you rely on any claim of a fix.
Sources
Last reviewed: 19 October 2026.
