PT-2025-53863 · Phpems · Phpems

Byebyedoggy · Published 2025-12-30 · Updated 2025-12-30 · CVE-2025-15244

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPEMS versions prior to 11.1

Description A flaw exists in PHPEMS related to the Purchase Request Handler component. This issue results in a race condition that can be triggered remotely. Exploitation requires a high level of complexity and is considered difficult. The details of the exploit have been publicly disclosed.

Recommendations Update PHPEMS to version 11.1 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-15244

Affected Products

Phpems

References · 8

• 🔥 https://byebydoggy.github.io/post/2025/1229-phpems-points-race-condition-poc · Exploit
• https://osv.dev/vulnerability/CVE-2025-15244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15244 · Security Note
• https://twitter.com/CVEnew/status/2005954026454618174 · Twitter Post
• https://vuldb.com/?ctiid.338634 · Note
• https://vuldb.com/?id.338634 · Note
• https://vuldb.com/?submit.725727 · Note
• https://t.me/cveNotify/147126 · Telegram Post