PT-2025-35157 · Itsourcecode · Apartment Management System

Zzb2 · Published 2025-08-29 · Updated 2025-09-03 · CVE-2025-9598

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Apartment Management System version 1.0

Description A security flaw exists in itsourcecode Apartment Management System 1.0. The issue involves SQL injection in the /setting/year setup.php file through manipulation of the txtXYear argument. This can be initiated remotely. The exploit has been released publicly.

Recommendations As a temporary workaround, consider restricting access to the /setting/year setup.php file to minimize the risk of exploitation. Avoid using the txtXYear argument in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-9598

Affected Products

Apartment Management System

References · 11

• 🔥 https://github.com/zzb1388/cve/issues/53 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9598 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9598 · Vendor Advisory
• https://t.me/cveNotify/133880 · Telegram Post
• https://twitter.com/cracbot/status/1963195308168364514 · Twitter Post
• https://vuldb.com/?ctiid.321772 · Note
• https://itsourcecode.com · Note
• https://vuldb.com/?id.321772 · Note
• https://vuldb.com/?submit.636364 · Note
• https://t.me/CVEtracker/31183 · Telegram Post
• https://twitter.com/CVEnew/status/1961282410198544819 · Twitter Post