PT-2025-10983 · Unknown · Lovecardsv2

N0El4Kls · Published 2025-03-12 · Updated 2025-03-12 · CVE-2025-2218

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: LoveCards LoveCardsV2 versions up to 2.3.2

Description: A critical vulnerability has been found in the Setting Handler component, affecting unknown code of the file /api/system/other. This leads to improper access controls and can be initiated remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations: For LoveCards LoveCardsV2 versions up to 2.3.2, consider restricting access to the /api/system/other endpoint until a patch is available. As a temporary workaround, review and tighten access controls to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-2218

Affected Products

Lovecardsv2

References · 8

• 🔥 https://ctf-n0el4kls.notion.site/LoveCardsV2-Unauthentication-to-RCE-Vulnerability-19841990f44780de8263c1f77a007a83?pvs=4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-2218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2218 · Security Note
• https://vuldb.com/?submit.512351 · Note
• https://vuldb.com/?id.299290 · Note
• https://vuldb.com/?ctiid.299290 · Note
• https://t.me/cvenotify/114403 · Telegram Post
• https://twitter.com/CVEnew/status/1899713898082631681 · Twitter Post