This vulnerability in Busiprof arises from insufficient protection against CSRF attacks, which enables attackers to trick authenticated users into uploading a web shell to the server. The affected versions include all releases up to 2.5.2. The vulnerability is publicly disclosed but lacks a CVSS score and vendor-provided remediation details. The product is not a cloud service, so remediation depends on vendor or user patching. No exploit activity has been confirmed.

Successful exploitation allows an attacker to upload a web shell, which can lead to unauthorized remote code execution and full compromise of the affected web server. This poses a significant security risk to the confidentiality, integrity, and availability of the system hosting Busiprof.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens, restricting upload functionality, or disabling vulnerable features if possible. Monitor for vendor updates and apply patches promptly once available.