PT-2025-22860 · Wcms · Wcms

Tttlw1024 · Published 2025-05-25 · Updated 2025-06-03 · CVE-2025-5149

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WCMS versions up to 8.3.11

Description A critical issue has been found in the Login component, specifically affecting the getMemberByUid function. The manipulation of the uid argument leads to improper authentication, allowing for remote attacks. The complexity of an attack is rather high, and the exploitation appears to be difficult. The issue has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations For WCMS versions up to 8.3.11, as a temporary workaround, consider disabling the getMemberByUid function until a patch is available. Restrict access to the /index.php?articleadmin/getallcon endpoint to minimize the risk of exploitation. Avoid using the uid argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-5149

Affected Products

Wcms

References · 12

• 🔥 https://gitee.com/nwtmd5/cve/issues/IC6O7D · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5149 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5149 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1926630874075869469 · Twitter Post
• https://vuldb.com/?submit.574590 · Note
• https://twitter.com/dailycve/status/1929900587522326781 · Twitter Post
• https://vuldb.com/?ctiid.310237 · Note
• https://t.me/cvenotify/124461 · Telegram Post
• https://vuldb.com/?id.310237 · Note
• https://t.me/cvenotify/123557 · Telegram Post
• https://twitter.com/CVEnew/status/1926632003085935008 · Twitter Post
• https://t.me/cvetracker/24598 · Telegram Post