PT-2025-17475 · Mrcms+1 · Mrcms+1

Baihekuz · Published 2025-04-21 · Updated 2025-05-06 · CVE-2025-4292

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MRCMS version 3.1.3 ASUS router (affected versions not specified)

Description A vulnerability has been found that allows for cross-site scripting through the manipulation of the Username argument in the file /admin/user/edit.do of the Edit User Page component. The attack can be launched remotely. Additionally, a flaw in ASUS routers, when AiCloud is enabled, can allow hackers to access the network from a distance, potentially leading to spying or network disruption.

Recommendations For MRCMS version 3.1.3, consider disabling the Edit User Page component or restricting access to the /admin/user/edit.do file until a patch is available. For ASUS routers, disable AiCloud to minimize the risk of exploitation. Avoid using the Username argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-4292

Affected Products

Mrcms

Mushroom

References · 11

• 🔥 https://github.com/bdkuzma/vuln/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4292 · Security Note
• https://t.me/cvenotify/120904 · Telegram Post
• https://vuldb.com/?ctiid.307399 · Note
• https://t.me/cvetracker/23096 · Telegram Post
• https://t.me/cvedetector/24517 · Telegram Post
• https://vuldb.com/?submit.563533 · Note
• https://twitter.com/grok/status/1914448239740510631 · Twitter Post
• https://vuldb.com/?id.307399 · Note
• https://twitter.com/CVEnew/status/1919525292374425605 · Twitter Post