PT-2025-47061 · Bestfeng · Bestfeng Oa Git Free

Youran · Published 2025-11-15 · Updated 2025-11-15 · CVE-2025-13209

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bestfeng oa git free versions up to 9.5

Description A flaw exists in bestfeng oa git free up to version 9.5. The issue is related to the manipulation of the writeProp argument within the updateWriteBack function located in the file yimioa-oa9.5serverc-flowsrcmainjavacomcloudweboacontrollerWorkflowPredefineController.java. This manipulation can lead to XML External Entity (XXE) reference. The attack can be carried out remotely, and an exploit has been publicly released.

Recommendations Versions prior to 9.5 should be updated. As a temporary workaround, consider restricting access to the updateWriteBack function until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2025-13209

Affected Products

Bestfeng Oa Git Free

References · 8

• 🔥 https://github.com/bkglfpp/CVE-md/blob/main/%E4%BA%91%E7%BD%91%E5%8D%8F%E5%90%8C%E5%8A%9E%E5%85%AC%E7%B3%BB%E7%BB%9F/XXE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13209 · Security Note
• https://twitter.com/CVEnew/status/1989766810758254926 · Twitter Post
• https://vuldb.com/?submit.685626 · Note
• https://vuldb.com/?ctiid.332528 · Note
• https://vuldb.com/?id.332528 · Note
• https://t.me/cveNotify/142926 · Telegram Post
• https://t.me/CVEtracker/37429 · Telegram Post