CVE-2025-8808
xujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 10, 2025
- Updated
- Aug 12, 2025
- Reserved
- Aug 9, 2025
Description
A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-module-admin/user/ajax/save of the component com.jeff.tianti.controller. The manipulation leads to csv injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
tianti 天梯xujeff |
|
References
- VDB-319337 | xujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injectionvdb-entrytechnical-description
- VDB-319337 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #626673 | Tianti Project Tianti 2.3 CSV Injectionthird-party-advisory
- https://github.com/N1n3b9S/cve/issues/16exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.