PT-2025-48065 · Primakon · Primakon Pi Portal

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-64062

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18

Description The /api/V2/pp users?email endpoint lacks proper server-side validation against the authenticated session. Manipulating the email parameter to an arbitrary value, such as [e-mail], allows an attacker to assume a session and gain full access to the target user's data and privileges. Leaving the email parameter blank defaults the application to the first user in the list, typically the application administrator, resulting in privilege escalation.

Recommendations Primakon Pi Portal version 1.0.18: Implement robust server-side validation for the email parameter in the /api/V2/pp users?email endpoint to ensure it corresponds to the authenticated session.

Exploit

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-64062

Affected Products

Primakon Pi Portal

References · 7

• 🔥 https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64062.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64062 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64062 · Vendor Advisory
• https://t.me/CVEtracker/38211 · Telegram Post
• https://twitter.com/CVEnew/status/1993391925282394384 · Twitter Post
• https://t.me/cveNotify/144394 · Telegram Post
• https://primakon.com/rjesenja/primakon-pcm · Note