PT-2025-17580 · Codemers · Codemers Klims

CVE-2025-43948 · Publicado 2025-04-22 · Atualizado 2025-04-23

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Codemers KLIMS version 1.6.DEV

Description The issue allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier, such as for sorting, which will get executed on the server side.

Recommendations For Codemers KLIMS version 1.6.DEV, consider restricting the input values for parameters or qualifiers to prevent Python code injection until a patch is available. As a temporary workaround, restrict access to sensitive server-side functionality to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2025-43948

Produtos afetados

Codemers Klims

Referências · 7

• 🔥 https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43948 · Exploit
• https://t.me/cvetracker/22155 · Publicação no Telegram
• https://t.me/cvedetector/23546 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1914746243613442131 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-43948 · Nota de Segurança
• https://twitter.com/cybercronai/status/1915190333962399896 · Publicação no Twitter
• https://de.linkedin.com/company/codemers · Nota