PT-2025-53861 · Phpems · Phpems

Byebyedoggy · Published 2025-12-30 · Updated 2025-12-30 · CVE-2025-15242

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPEMS versions prior to 11.1

Description A race condition exists in the Coupon Handler component of PHPEMS. This issue can be exploited remotely, though the complexity of an attack is considered high and exploitability is difficult. The exploit is publicly available. The vulnerable element is an unknown function within the Coupon Handler.

Recommendations Update PHPEMS to version 11.1 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-15242

Affected Products

Phpems

References · 10

• 🔥 https://byebydoggy.github.io/post/2025/1229-phpems-coupon-recharge-race-condition-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15242 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15242 · Vendor Advisory
• https://vuldb.com/?ctiid.338632 · Note
• https://vuldb.com/?submit.725661 · Note
• https://twitter.com/VulmonFeeds/status/2005964573778514081 · Twitter Post
• https://t.me/cveNotify/147123 · Telegram Post
• https://twitter.com/CVEnew/status/2005938666007392496 · Twitter Post
• https://t.me/CVEtracker/40931 · Telegram Post
• https://vuldb.com/?id.338632 · Note