Security readout for executives and security teams
Plain-English summary
CVE-2022-25574 is a stored cross-site scripting issue tied to an upload function in /admin/show.php. A crafted image file can cause attacker-supplied script or HTML to run in a victim’s browser. The public record does not clearly identify affected product versions or a vendor fix.
Executive priority
Treat as a targeted web-application risk rather than an internet-wide emergency. Prioritize review if your organization runs the referenced code or exposes admin uploads. Business urgency is lower where the application is absent or admin access is tightly restricted.
Technical view
The CVE describes stored XSS in /admin/show.php’s upload function, triggered through a crafted image file. Impact depends on who can upload files and who later views the stored content. No CVSS score, CWE, affected CPE, or remediation details are provided in the supplied sources.
Likely exposure
Likely limited to deployments containing the referenced /admin/show.php upload functionality, apparently associated with the aqianhei/aqian GitHub issue. Exposure is uncertain because the CVE record lists affected vendor, product, and versions as n/a.
Exploitation context
The sources do not report active exploitation, and the CVE is not marked in KEV. Exploitation would require the vulnerable upload path to accept a crafted image and later render stored content to another user, potentially an administrator.
Researcher notes
Evidence is sparse. The CVE record provides a vulnerable path and attack class but lacks product metadata, affected versions, CVSS, and fix details. Avoid assuming broader impact beyond the referenced GitHub issue without confirming the codebase and upload/rendering behavior.
Mitigation direction
- Check whether any deployed application includes /admin/show.php upload functionality.
- Review the referenced GitHub issue and project guidance for fixes or safe versions.
- Restrict access to administrative upload functions to trusted users only.
- Ensure uploaded files are validated and rendered without executing embedded script content.
- Monitor vendor or maintainer channels because no patch is named in the supplied sources.
Validation and detection
- Search application code and routes for /admin/show.php and related upload handling.
- Inventory any use of the aqianhei/aqian project or derived code.
- Review upload storage and rendering logic for unsafe HTML or script handling.
- Check web logs for unexpected uploads to the administrative show.php path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-25574 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/aqianhei/aqian/issues/1#issue-1142472278CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.