PT-2025-16308 · Laravel+4 · Laravel+4

Published

2025-04-15

·

Updated

2025-04-15

·

CVE-2025-3579

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Aidex versions prior to 1.7
Description The issue allows an authenticated malicious user to execute unauthorized commands within the system by exploiting an open registry. This can include executing operating system commands, interacting with internal services such as PHP or MySQL, and invoking native functions of the framework used, like Laravel or Symfony. The execution is achieved through Prompt Injection attacks via the "/api//message" endpoint, by manipulating the content of the content parameter.
Recommendations For versions prior to 1.7, consider updating to version 1.7 or later to resolve the issue. As a temporary workaround, restrict access to the "/api//message" endpoint to minimize the risk of exploitation. Additionally, avoid using the content parameter in the affected API endpoint until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-3579

Affected Products

Aidex
Laravel
Mysql Server
Php
Symfony