PT-2023-20049 · Unknown · Cleverstupiddog Yf-Exam

Cleverstupiddog · Publicado 2023-03-03 · Atualizado 2025-03-07 · CVE-2023-25403

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CleverStupidDog yf-exam version 1.8.0

Description The issue concerns an authentication bypass. It is caused by the program using a fixed JWT key, and the stored key utilizes username format characters. This allows any user who logged in within 24 hours to have a token forged with their username, thereby bypassing authentication.

Recommendations For CleverStupidDog yf-exam version 1.8.0, consider regenerating the JWT key with a secure, non-fixed value to prevent token forgery. Additionally, restrict the use of username format characters in stored keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-25403

Produtos afetados

Cleverstupiddog Yf-Exam

Referências · 6

• 🔥 https://github.com/CleverStupidDog/yf-exam/issues/2 · Exploit
• 🔥 https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25403 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25403 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25403 · Aviso do Fabricante
• https://t.me/cvenotify/113870 · Publicação no Telegram
• https://t.me/cibsecurity/59417 · Publicação no Telegram