PT-2025-17471 · Unknown · Yxj2018 Springboot-Vue-Onlineexam

Lingmeng · Published 2025-04-21 · Updated 2025-10-15 · CVE-2025-3849

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions YXJ2018 SpringBoot-Vue-OnlineExam version 1.0

Description A vulnerability was found in YXJ2018 SpringBoot-Vue-OnlineExam, affecting unknown code of the file "/api/studentPWD". The manipulation of the studentId argument leads to unverified password change. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For YXJ2018 SpringBoot-Vue-OnlineExam version 1.0, consider disabling the "/api/studentPWD" endpoint until a patch is available to prevent unverified password changes. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the studentId argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

CWE-620

Related Identifiers

CVE-2025-3849

Affected Products

Yxj2018 Springboot-Vue-Onlineexam

References · 13

• 🔥 https://github.com/YXJ2018/SpringBoot-Vue-OnlineExam/issues/74 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3849 · Security Note
• https://vuldb.com/?ctiid.305776 · Note
• https://t.me/cveNotify/138880 · Telegram Post
• https://vuldb.com/?id.305776 · Note
• https://t.me/cvedetector/23477 · Telegram Post
• https://vuldb.com/?submit.556283 · Note
• https://t.me/cvetracker/22081 · Telegram Post
• https://twitter.com/CVEnew/status/1914466784385933762 · Twitter Post
• https://twitter.com/transilienceai/status/1914527428795638226 · Twitter Post
• https://twitter.com/transilienceai/status/1914532491169251490 · Twitter Post
• https://t.me/cvenotify/119276 · Telegram Post
• https://twitter.com/transilienceai/status/1914527418377019808 · Twitter Post