CVE-2025-10394 Overview
CVE-2025-10394 is a code injection vulnerability [CWE-74] in the fcba_zzm ics-park Smart Park Management System 2.0. The flaw resides in the Scheduled Task Module, specifically in the ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/JobController.java file. An authenticated remote attacker with high privileges can manipulate the affected function to inject and execute code through the scheduled task interface. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.
Critical Impact
Authenticated attackers can inject code via the Quartz scheduled task controller, potentially leading to arbitrary command execution within the application context.
Affected Products
- fcba_zzm ics-park Smart Park Management System 2.0
- Component: Scheduled Task Module (JobController.java)
- Underlying framework: RuoYi Quartz scheduler integration
Discovery Timeline
- 2025-09-14 - CVE-2025-10394 published to the National Vulnerability Database (NVD)
- 2026-04-29 - Last updated in the NVD database
Technical Details for CVE-2025-10394
Vulnerability Analysis
The vulnerability exists in the Quartz scheduled task controller of the Smart Park Management System. The JobController.java class accepts user-controlled input that is later evaluated as part of a scheduled job definition. Because the input is not properly validated or sanitized, an attacker can craft a payload that the application interprets as executable code rather than data. The flaw is classified under [CWE-74] - Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).
Exploitation requires network access to the management interface and an authenticated account with elevated privileges. While the privilege requirement reduces opportunistic exploitation, insider abuse or compromised administrator credentials make this a meaningful risk for deployed systems.
Root Cause
The root cause is the absence of strict allow-listing on job invocation targets within the RuoYi-derived Quartz job handler. The controller method maps user-supplied strings to method invocations without validating that the target class or method belongs to a safe, predefined set. This pattern allows attackers to reference arbitrary application classes during job scheduling.
Attack Vector
An attacker authenticates to the Smart Park Management System with a privileged account. The attacker then submits a crafted scheduled task definition through the job creation or update endpoint exposed by JobController.java. When the Quartz scheduler executes the job, the injected expression triggers code execution within the Java application context. The full technical write-up is available in the GitHub CVE Issue and the VulDB entry #323829.
Detection Methods for CVE-2025-10394
Indicators of Compromise
- Unexpected entries in the Quartz QRTZ_JOB_DETAILS or sys_job tables referencing unusual Java classes or methods.
- Outbound network connections originating from the Java application server immediately after a scheduled task fires.
- Application logs showing JobController invocations from non-administrative source IP addresses.
- New or modified scheduled jobs containing reflection-style invocation targets such as Runtime.getRuntime or shell command strings.
Detection Strategies
- Review web access logs for POST or PUT requests to /monitor/job/add, /monitor/job/edit, or equivalent Quartz job endpoints.
- Correlate job creation events with subsequent process creation on the host running the application server.
- Inspect database audit trails for inserts into the scheduled task tables outside normal administrative windows.
Monitoring Recommendations
- Enable verbose audit logging for the Quartz scheduler component and ship logs to a centralized analytics platform.
- Alert on any process spawned by the Java application server that is not part of the documented baseline.
- Monitor administrator account usage for the Smart Park Management System and flag logins from unfamiliar geolocations or hosts.
How to Mitigate CVE-2025-10394
Immediate Actions Required
- Restrict network access to the Smart Park Management System administrative interface to trusted management networks only.
- Rotate credentials for all privileged accounts and enforce strong, unique passwords with multi-factor authentication where supported.
- Audit existing scheduled tasks in the Quartz module and remove any entries that reference unexpected Java classes or shell commands.
- Monitor the GitHub CVE Issue and VulDB references for vendor patch availability.
Patch Information
At the time of publication, no official vendor advisory or patched release has been published by fcba_zzm for the ics-park Smart Park Management System 2.0. Operators should track the VulDB submission #645729 for updates and consider implementing compensating controls until a fix is released.
Workarounds
- Disable the Quartz scheduled task module if it is not required for business operations.
- Place the application behind a web application firewall (WAF) and block requests to job management endpoints from untrusted sources.
- Apply the principle of least privilege so that no operational account has scheduled task management rights unless strictly necessary.
- Implement an allow-list at the application layer that restricts Quartz job invocation targets to a small set of vetted classes and methods.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
