The vulnerability CVE-2025-5243 affects SMG Software's Information Portal versions before 13.06.2025. It is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The issue allows an attacker to upload malicious files without restriction and execute OS command injection, enabling code injection, web shell upload, and code inclusion on the affected server. The vulnerability is remotely exploitable without authentication (AV:N/AC:L/PR:N/UI:N) and impacts confidentiality, integrity, and availability at the highest level (C:H/I:H/A:H).

Successful exploitation can lead to complete compromise of the affected Information Portal server, including unauthorized code execution, web shell deployment, and potential full control over the system. This can result in data theft, service disruption, and further network penetration. The CVSS score of 10 reflects the critical nature and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload functionality where possible, implement strict file type validation, and monitor for suspicious uploads. Avoid exposing the affected portal to untrusted networks. Follow vendor updates closely for an official patch or mitigation instructions.