Full Report
CERT Polska has received a report about 4 vulnerabilities (from CVE-2025-1980 to CVE-2025-1983) found in Symfonia Ready_ software.
Analysis Summary
This summary consolidates the information for the four reported vulnerabilities affecting Symfonia Ready\_ software. Since specific CVSS scores, exploitation status, patches, and detailed impact levels were not provided in the source text beyond the technical descriptions, these fields are marked as "Not Available (NA)" or inferred from the description.
---
# Vulnerability: Multiple Vulnerabilities in Symfonia Ready\_ Software (CVE-2025-1980 to CVE-2025-1983)
## CVE Details
| CVE ID | CVSS Score | Severity | CWE |
| :--- | :--- | :--- | :--- |
| CVE-2025-1980 | NA | NA | CWE-434 (Unrestricted Upload of File with Dangerous Type) |
| CVE-2025-1981 | NA | NA | CWE-89 (SQL Injection) |
| CVE-2025-1982 | NA | NA | CWE-552 (Files or Directories Accessible to External Parties) |
| CVE-2025-1983 | NA | NA | CWE-79 (Cross-site Scripting) |
## Affected Systems
- **Products:** Symfonia Ready\_
- **Versions:** From 7.0.0.0 through 7.19.39.23
- **Configurations:** CVE-2025-1980 specifically notes impact when the server was misconfigured as it was by default around the turn of 2021 and 2022.
## Vulnerability Description
The four vulnerabilities reside within different modules of the Symfonia Ready\_ application:
1. **CVE-2025-1980 (Unrestricted File Upload/RCE):** The Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured (as by default when installed around 2021/2022), this can lead to Remote Code Execution (RCE).
2. **CVE-2025-1981 (SQL Injection):** Improper neutralization of input provided by a low-privileged user in the file search functionality within the Invoices module allows for SQL Injection attacks.
3. **CVE-2025-1982 (Local File Inclusion - LFI):** A vulnerability in Ready's attachment upload panel allows a low-privileged user to input a link to a local file using the `file://` protocol, enabling them to read the content of local system files.
4. **CVE-2025-1983 (Stored XSS):** A Cross-Site Scripting vulnerability within the File Explorer upload functionality allows an attacker to inject arbitrary JavaScript code into a file name. This code is stored on the server and executed every time a user interacts with the uploaded file.
## Exploitation
- **Status (Inferred):** Detailed status not provided, assumed unpatched/vulnerable until remediation. PoC availability not specified, but RCE, SQLi, and LFI often imply high exploitability.
- **Complexity (Inferred):** Varies by CVE; RCE/SQLi/LFI are generally considered Medium to Low complexity for skilled attackers.
- **Attack Vector (Inferred):** Primarily Network/Adjacent, leveraging uploaded files or module interactions.
## Impact
| CVE | Confidentiality | Integrity | Availability |
| :--- | :--- | :--- | :--- |
| CVE-2025-1980 | High (RCE) | High (RCE) | High (RCE) |
| CVE-2025-1981 | High (Data Leak via SQLi) | High (Data Modification/Exfiltration) | NA |
| CVE-2025-1982 | High (System File Disclosure) | NA | NA |
| CVE-2025-1983 | Medium (Session Hijacking via XSS) | Medium (Script Execution) | NA |
## Remediation
### Patches
- The source text confirms patches are available as part of coordinated disclosure, but **specific patch versions or release dates are not listed.** Users must check the official Symfonia advisories for exact versions fixing versions 7.0.0.0 through 7.19.39.23.
### Workarounds
- **No specific workarounds were provided in the source material.**
1. **CVE-2025-1980:** Restrict file upload functionality permissions or enforce strict file type validation. Review and correct default server misconfigurations related to uploaded files.
2. **General:** Apply principle of least privilege to users accessing the Invoices module and File Explorer.
## Detection
- **Indicators of Compromise (Inferred):**
- Unusual server execution logs correlating with file upload events (CVE-2025-1980).
- Database query errors or unexpected SQL traffic patterns (CVE-2025-1981).
- Access attempts to sensitive local files originating from application directories (CVE-2025-1982).
- Unsanctioned JavaScript execution in web application sessions (CVE-2025-1983).
- **Detection Methods and Tools:** Standard WAFs/IPS/IDS systems should be monitored for known SQLi strings, file protocol usage (`file://`), and script injection payloads. Application layer logging must be enabled and reviewed.
## References
- Vendor Advisory: Not directly linked, search Symfonia documentation for advisories released around mid-April 2025.
- CERT Polska Advisory Index: `https://cert.pl/en/cve/`
- Coordinated Disclosure Process: `https://cert.pl/en/cvd/`