CVE-2025-65472
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| easyimages2.0_project | easyimages2.0 | to 2.8.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unexpected POST requests to the /admin/admin.inc.php endpoint, especially those that change administrator credentials without proper authorization. You can use network traffic analysis tools like Wireshark or tcpdump to capture HTTP POST requests targeting /admin/admin.inc.php. Additionally, inspecting web server logs for suspicious POST requests that include password change parameters can help detect exploitation attempts. For example, using grep on server logs: grep '/admin/admin.inc.php' /path/to/access.log | grep POST. Also, monitoring for unexpected file uploads to the cache folder, such as congsec.php, can indicate exploitation. There are no specific commands provided, but these general approaches apply. [1]
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below. It allows attackers to escalate their privileges to Administrator by tricking a user into interacting with a malicious web page.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain Administrator privileges without authorization, potentially leading to unauthorized access, control over the application, and manipulation of sensitive data or settings.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the /admin/admin.inc.php endpoint to trusted IP addresses or networks. 2) Implement CSRF protection tokens in the admin interface to prevent unauthorized POST requests. 3) Update EasyImages to a version later than 2.8.6 if available. 4) Monitor and audit administrator password changes and file uploads to the cache folder. 5) If possible, temporarily disable the admin interface or require additional authentication factors until a patch is applied. 6) Review and remove any suspicious files such as web shells (e.g., congsec.php) from the server. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unexpected POST requests to the /admin/admin.inc.php endpoint, especially those that change administrator credentials without proper authorization. Using tools like Burp Suite to intercept and analyze HTTP requests can help identify suspicious CSRF payloads. Additionally, checking web server logs for POST requests to /admin/admin.inc.php with password change parameters or unusual activity such as sudden admin password changes can indicate exploitation attempts. Commands to check logs might include: 1. grep 'POST /admin/admin.inc.php' /var/log/apache2/access.log 2. grep 'password' /var/log/apache2/access.log 3. Using Burp Suite or similar proxy tools to capture and analyze HTTP traffic for CSRF attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Applying access controls to restrict access to the /admin/admin.inc.php endpoint to trusted IPs or users. 2. Implementing anti-CSRF tokens in the admin interface to prevent unauthorized POST requests. 3. Updating EasyImages to a version later than 2.8.6 if available. 4. Monitoring and auditing admin password changes and uploaded files for suspicious activity. 5. Educating administrators to avoid visiting untrusted web pages while logged into the admin panel. 6. If possible, temporarily disabling the vulnerable admin functionality until a patch is applied. [1]