PT-2025-43876 · Unknown · Bdtask Flight Booking

4M3Rr0R + 1 · Published 2025-10-27 · Updated 2025-11-21 · CVE-2025-12222

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bdtask Flight Booking Software versions prior to 3.1

Description A security issue exists in Bdtask Flight Booking Software. The issue involves unrestricted upload capabilities through an unknown functionality within the /admin/transaction/deposit file of the Deposit Handler component. This manipulation can be initiated remotely. The exploit has been publicly disclosed, and the vendor was informed but did not respond.

Recommendations Update Bdtask Flight Booking Software to a version later than 3.1.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-12222

Affected Products

Bdtask Flight Booking

References · 10

• 🔥 https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12222.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12222 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12222 · Vendor Advisory
• https://t.me/cveNotify/143669 · Telegram Post
• https://t.me/cveNotify/140385 · Telegram Post
• https://vuldb.com/?id.329892 · Note
• https://vuldb.com/?ctiid.329892 · Note
• https://vuldb.com/?submit.673424 · Note
• https://t.me/CVEtracker/35789 · Telegram Post
• https://twitter.com/CVEnew/status/1982671062916583520 · Twitter Post