PT-2025-21812 · Unknown · Kanwangzjm Funiture

Shenxiusecurity · Published 2025-05-17 · Updated 2025-05-18 · CVE-2025-4838

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: kanwangzjm Funiture versions up to 71ca0fb0658b3d839d9e049ac36429207f05329b

Description: A problematic issue was found in the doPost function of the LoginServlet.java file, affecting the Login component. The manipulation of the ret argument leads to an open redirect. This issue can be exploited remotely.

Recommendations: For versions up to 71ca0fb0658b3d839d9e049ac36429207f05329b, as a temporary workaround, consider restricting access to the doPost function of the LoginServlet.java file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-4838

Affected Products

Kanwangzjm Funiture

References · 8

• 🔥 https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250510-01.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4838 · Security Note
• https://vuldb.com/?submit.574825 · Note
• https://t.me/cvetracker/24117 · Telegram Post
• https://twitter.com/CVEnew/status/1923869437851206092 · Twitter Post
• https://vuldb.com/?id.309306 · Note
• https://t.me/cvenotify/122781 · Telegram Post
• https://vuldb.com/?ctiid.309306 · Note