CVE-2025-70141

Katalog CVE

CVSS 9.4 · Critical EPSS 0,70%

Kerentanan Missing Authentication for Critical Function pada oretnom23 customer support system. Skor CVSS 3.1 9.4 (Critical) menurut CISA ADP.

Deskripsi (NVD)

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.

Rincian

Terbit di NVD

18 Februari 2026

Terakhir diubah

8 September 2026

Status NVD

Modified

CVSS 3.1

9.4 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-862: Missing Authorization

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC/ exploit · mitigasi · advisory pihak ketiga
• https://0x0bito.github.io/posts/CVE-2025-70141-Customer-Support-BAC/
• https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+S... product