PT-2025-34789 · Digital Creators Club Trap · Traq

Ras0Q · Published 2025-08-26 · Updated 2025-08-29 · CVE-2025-57813

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: traQ versions prior to 3.25.0

Description: traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by placing a high load on the database, potentially allowing unauthorized access to the recorded sensitive information by those with log file access.

Recommendations: Upgrade to version 3.25.0 or later. As a temporary workaround, review access permissions for SQL error logs and strictly limit access to prevent unauthorized users from viewing them.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-57813

GHSA-27R7-3M9X-R533

GO-2025-3913

Affected Products

Traq

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57813.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57813 · Security Note
• https://osv.dev/vulnerability/GHSA-27r7-3m9x-r533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57813 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3913 · Vendor Advisory
• https://github.com/traPtitech/traQ/pull/2787 · Note
• https://github.com/traPtitech/traQ/pull/2788 · Note
• https://github.com/traPtitech/traQ/security/advisories/GHSA-27r7-3m9x-r533 · Note
• https://github.com/traPtitech/traQ · Note
• https://github.com/traPtitech/traQ/commit/ce5da94f5d5a8348f9ecdc82140b6f53b3721698 · Note
• https://twitter.com/CVEnew/status/1960383318198771868 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960450583132828029 · Twitter Post
• https://t.me/CVEtracker/30942 · Telegram Post
• https://pkg.go.dev/vuln/GO-2025-3913 · Note