PT-2025-46997 · Codecanyon · Saleserp

4M3Rr0R · Published 2025-11-14 · Updated 2025-11-24 · CVE-2025-13177

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon SalesERP versions up to 20250728

Description A cross-site request forgery issue exists in Bdtask/CodeCanyon SalesERP. The issue affects an unspecified component and allows for remote execution of attacks. The exploit is publicly available. The vendor was notified of this issue but did not provide a response.

Recommendations Versions up to 20250728 should be updated when a fix becomes available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2025-13177

Affected Products

Saleserp

References · 9

• 🔥 https://github.com/4m3rr0r/PoCVulDb/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13177 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13177 · Vendor Advisory
• https://vuldb.com/?id.332467 · Note
• https://t.me/cveNotify/143783 · Telegram Post
• https://vuldb.com/?ctiid.332467 · Note
• https://t.me/CVEtracker/37358 · Telegram Post
• https://twitter.com/CVEnew/status/1989441993915928722 · Twitter Post
• https://vuldb.com/?submit.684819 · Note