PT-2025-12271 · Gaizhenbiao · Chuanhuchatgpt

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9216

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/ChuanhuChatGPT versions as of commit 3856d4f

Description The issue arises from an authentication bypass, allowing any user to read and delete other users' chat history. This occurs because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. An attacker can pass another user's username to the get model function, gaining unauthorized access to that user's chat history.

Recommendations As a temporary workaround, consider restricting access to the get model function until a patch is available. Avoid using the username variable in the affected HTTP request until the issue is resolved. Update to a version that fixes the authentication bypass issue, ensuring that user credentials are handled securely.

Exploit

Fix

Weakness Enumeration

CWE-304

Related Identifiers

CVE-2024-9216

PYSEC-2025-97

Affected Products

Chuanhuchatgpt

References · 5

• 🔥 https://huntr.com/bounties/21e54c3f-e2d7-423b-9890-1f0cb99af4dd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9216 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-97 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9216 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902670961389998430 · Twitter Post