PT-2025-27946 · Monitorr · Monitorr

Matans · Published 2025-07-04 · Updated 2025-07-04 · CVE-2025-7060

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Monitorr versions up to 1.7.6m

Description: A vulnerability was found in Monitorr, affecting an unknown part of the file assets/config/ installation/mkdbajax.php of the component Installer. The manipulation of the datadir argument leads to improper input validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations: For versions up to 1.7.6m, as a temporary workaround, consider restricting access to the mkdbajax.php file until a patch is available. Additionally, avoid using the datadir argument in the affected Installer component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-7060

Affected Products

Monitorr

References · 7

• 🔥 https://vuldb.com/?submit.602080 · Exploit
• https://osv.dev/vulnerability/CVE-2025-7060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7060 · Security Note
• https://twitter.com/CVEnew/status/1941097262391648493 · Twitter Post
• https://vuldb.com/?ctiid.314835 · Note
• https://vuldb.com/?id.314835 · Note
• https://twitter.com/ZeroDayCVE/status/1941097798654742797 · Twitter Post