Description
在 Samsung MagicINFO 9 Server 21.1052 之前版本中，受限目录的路径名限制不当，攻击者便可将任意文件写入系统授权机构
三星MagicINFO CVE-2025-4632 文件上传
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-4632
https://www.cve.org/CVERecord?id=CVE-2025-4632
https://www.tenable.com/cve/CVE-2025-4632
https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/
https://www.huntress.com/blog/post-exploitation-activities-observed-from-samsung-magicinfo-9-server-flaw
https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html
https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4632.yaml
https://www.sentinelone.com/vulnerability-database/cve-2025-4632/
https://www.darkreading.com/endpoint-security/attackers-target-samsung-magicinfo-server-bug