ShowDoc Vulnerability Exploited in Recent Server Attacks, patch released in 2020

Post Views: 6

A Five-Year-Old Vulnerability in ShowDoc Enables Global Server Takeovers

A previously patched vulnerability in the widely used document management platform, ShowDoc, has resurfaced and is currently being exploited by hackers worldwide.

The Issue:

The issue, identified as CVE-2025-0520, is an unrestricted file upload flaw that enables remote code execution (RCE) and full server takeover.

According to security researchers, the vulnerability has already been exploited in over 2,000 instances of ShowDoc, predominantly in China.

ShowDoc Details:

ShowDoc is a PHP-based application.
The unrestricted file upload flaw allows hackers to deploy web shells on compromised servers.
Web shells enable unauthorized individuals to execute commands on a system remotely, giving attackers complete control over the server.

CVE-2025-0520 Severity:

The vulnerability’s high CVSS score of 9.4 out of 10 underscores its severity.

Security experts have warned that hackers are actively targeting this vulnerability, and the number of exploits is expected to increase.

Mitigation Steps:

To mitigate the risk, users must update their ShowDoc installations to the latest version, which is 3.8.1.

“This vulnerability highlights the importance of keeping software up-to-date, especially when it comes to critical applications like ShowDoc,” said Caitlin Condon, VP of Security Research at VulnCheck. “Even software with a small user base can become a valuable asset for hackers, making it essential for organizations to monitor their infrastructure and stay informed about potential threats.”

Expert Insights:

Will Baxter, Head of Architecture & Platform and Field CISO at Team Cymru, emphasized the danger posed by long-tail vulnerabilities like CVE-2025-0520.

“Attackers continue to exploit these types of vulnerabilities as quiet entry points into exposed systems,” he warned. “It’s crucial for defenders to have external intelligence to understand how their infrastructure appears and behaves on the open internet.”