CVE-2025-10389
BaseFortify
Publication date: 2025-09-14
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| crmeb | crmeb | to 5.6.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10389 is a security flaw in CRMEB up to version 5.6.1, specifically in the save function of the SystemAdminServices.php file. The vulnerability allows low-permission users to reset the administrator password because the system does not properly check if the user has authorization to modify the targeted administrator account. This improper authorization enables attackers to remotely manipulate the administrator password without permission. [1, 2]
How can this vulnerability impact me? :
This vulnerability can have a significant impact by allowing unauthorized users with low privileges to reset the administrator password remotely. This compromises system integrity and availability, potentially giving attackers full administrative control over the affected CRMEB installation. Such control can lead to unauthorized access, data manipulation, and disruption of services. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable file path 'app/services/system/admin/SystemAdminServices.php' in CRMEB versions up to 5.6.1. One method is to use Google dorking with queries like 'inurl:app/services/system/admin/SystemAdminServices.php' to identify potentially vulnerable targets. Additionally, monitoring for unauthorized attempts to invoke the 'save' function with manipulated 'id' parameters or unusual password reset activities by low-permission users could indicate exploitation attempts. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected component or product, as no known mitigations or countermeasures have been published. Since the vendor did not respond to early disclosure and no patches are available, removing or upgrading the vulnerable CRMEB installation is recommended to prevent exploitation. Restricting access to the vulnerable file path and monitoring for suspicious activity may also help reduce risk. [2]