CVE-2025-70758
Authentication Bypass in core-php-admin-panel via Missing exit() Call
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chetans9 | core-php-admin-panel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-703 | The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the chetans9 core-php-admin-panel application, specifically in the includes/auth_validate.php file. When a user is not authenticated, the application sends an HTTP redirect header to login.php but fails to call exit() immediately afterward. This omission allows remote unauthenticated attackers to bypass authentication and access protected pages.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves an authentication bypass due to missing exit() after an HTTP redirect in the PHP file includes/auth_validate.php. To detect this on your system, you can inspect the source code of includes/auth_validate.php for the presence of header("Location:login.php") without a subsequent exit() or die() call.'}, {'type': 'paragraph', 'content': 'Additionally, you can monitor HTTP traffic to see if unauthenticated requests are able to access protected pages that should require authentication.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect the vulnerability include:'}, {'type': 'list_item', 'content': 'Use grep to check the PHP file for the redirect without exit():\n grep -A 3 \'header("Location:login.php")\' includes/auth_validate.php'}, {'type': 'list_item', 'content': 'Use curl or wget to test access to protected pages without authentication:\n curl -I http://yourserver/protected_page.php'}, {'type': 'list_item', 'content': 'Check web server logs for unauthorized access attempts that succeeded.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this authentication bypass vulnerability, immediately update the includes/auth_validate.php file to ensure that after sending the HTTP redirect header (header("Location:login.php")), the script calls exit() or die() to stop further execution.'}, {'type': 'paragraph', 'content': 'This prevents unauthorized users from accessing protected pages after the redirect.'}, {'type': 'paragraph', 'content': 'If a patch or updated version of the core-php-admin-panel is available from the maintainer, apply it as soon as possible.'}, {'type': 'paragraph', 'content': 'In the meantime, restrict access to the application via network controls or web server configuration to trusted IPs if feasible.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to access protected areas of the application without proper authentication. As a result, attackers may gain access to sensitive information such as the customer database or other restricted data, potentially leading to data breaches or unauthorized actions within the admin panel.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know