PT-2023-20049 · Unknown · Cleverstupiddog Yf-Exam

Cleverstupiddog · Published 2023-03-03 · Updated 2025-03-07 · CVE-2023-25403

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CleverStupidDog yf-exam version 1.8.0

Description The issue concerns an authentication bypass. It is caused by the program using a fixed JWT key, and the stored key utilizes username format characters. This allows any user who logged in within 24 hours to have a token forged with their username, thereby bypassing authentication.

Recommendations For CleverStupidDog yf-exam version 1.8.0, consider regenerating the JWT key with a secure, non-fixed value to prevent token forgery. Additionally, restrict the use of username format characters in stored keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-25403

Affected Products

Cleverstupiddog Yf-Exam

References · 6

• 🔥 https://github.com/CleverStupidDog/yf-exam/issues/2 · Exploit
• 🔥 https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25403 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25403 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25403 · Vendor Advisory
• https://t.me/cvenotify/113870 · Telegram Post
• https://t.me/cibsecurity/59417 · Telegram Post