PT-2025-10442 · Shenzhen Sixun · Sixun Shanghui Group Business Management System

Yaozhang + 1 · Published 2025-03-09 · Updated 2025-03-09 · CVE-2025-2114

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Sixun Software Sixun Shanghui Group Business Management System version 7

Description A problematic issue has been found in the Reset Password Interface component, specifically affecting the file /WebPages/Adm/OperatorStop.asp. The manipulation of the OperId argument leads to improper authorization, allowing for remote attacks. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations For Shenzhen Sixun Software Sixun Shanghui Group Business Management System version 7, as a temporary workaround, consider restricting access to the Reset Password Interface or disabling the OperId argument manipulation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-2114

Affected Products

Sixun Shanghui Group Business Management System

References · 9

• 🔥 https://github.com/zhangbuneng/an-arbitrary-user-password-reset-vulnerability-in-the-Sixun-Shanghui-7-Group/issues/1#issue-2877317082 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2114 · Security Note
• https://twitter.com/CVETracker/status/1898826307993039010 · Twitter Post
• https://t.me/cvedetector/19912 · Telegram Post
• https://t.me/cvetracker/18759 · Telegram Post
• https://vuldb.com/?submit.506591 · Note
• https://vuldb.com/?ctiid.299009 · Note
• https://t.me/cvenotify/114007 · Telegram Post
• https://vuldb.com/?id.299009 · Note