PT-2025-22923 · Unknown · Summer Pearl Group Vacation Rental Management Platform

Alexperrakis · Publicado 2025-05-26 · Atualizado 2025-05-26 · CVE-2025-5181

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Summer Pearl Group Vacation Rental Management Platform version 1.0.1

Description A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTitle leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Summer Pearl Group Vacation Rental Management Platform version 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting access to the /spgpm/updateListing endpoint until the upgrade is applied. Additionally, avoid using the spgLsTitle argument in the affected endpoint until the issue is resolved.

Exploit

Correção

IDOR

Code Injection

XSS

Enumeração de Fraquezas

CWE-639

CWE-94

CWE-79

Identificadores relacionados

CVE-2025-5181

Produtos afetados

Summer Pearl Group Vacation Rental Management Platform

Referências · 11

• 🔥 https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS · Exploit
• 🔥 https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-inject-xss · Exploit
• 🔥 https://youtube.com/watch?v=0wwuatTa6sU · Exploit
• https://osv.dev/vulnerability/CVE-2025-5181 · Aviso do Fabricante
• https://t.me/cvetracker/24640 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-5181 · Nota de Segurança
• https://vuldb.com/?id.310269 · Nota
• https://vuldb.com/?submit.581383 · Nota
• https://twitter.com/CVEnew/status/1926956027787858191 · Publicação no Twitter
• https://vuldb.com/?ctiid.310269 · Nota
• https://summerpearlgroup.gr/spgpm/releases · Correção