PT-2025-22923 · Unknown · Summer Pearl Group Vacation Rental Management Platform

Alexperrakis · Published 2025-05-26 · Updated 2025-05-26 · CVE-2025-5181

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Summer Pearl Group Vacation Rental Management Platform version 1.0.1

Description A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTitle leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Summer Pearl Group Vacation Rental Management Platform version 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting access to the /spgpm/updateListing endpoint until the upgrade is applied. Additionally, avoid using the spgLsTitle argument in the affected endpoint until the issue is resolved.

Exploit

Fix

IDOR

Code Injection

XSS

Weakness Enumeration

CWE-639

CWE-94

CWE-79

Related Identifiers

CVE-2025-5181

Affected Products

Summer Pearl Group Vacation Rental Management Platform

References · 11

• 🔥 https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS · Exploit
• 🔥 https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-inject-xss · Exploit
• 🔥 https://youtube.com/watch?v=0wwuatTa6sU · Exploit
• https://osv.dev/vulnerability/CVE-2025-5181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5181 · Security Note
• https://summerpearlgroup.gr/spgpm/releases · Patch
• https://t.me/cvetracker/24640 · Telegram Post
• https://vuldb.com/?id.310269 · Note
• https://vuldb.com/?submit.581383 · Note
• https://twitter.com/CVEnew/status/1926956027787858191 · Twitter Post
• https://vuldb.com/?ctiid.310269 · Note