PT-2025-54460 · Uasoft · Uasoft Badaso

Hiro · Published 2025-12-31 · Updated 2026-01-02 · CVE-2025-15398

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Uasoft badaso versions up to 2.9.7

Description A security issue exists in Uasoft badaso up to version 2.9.7 related to weak password recovery. The forgetPassword function within the src/Controllers/BadasoAuthController.php file of the Token Handler component is affected. This manipulation can be executed remotely and is characterized by high complexity, though exploitability is considered difficult. The exploit has been publicly disclosed, and the vendor was notified but did not respond.

Recommendations Versions prior to 2.9.7 should be updated. As a temporary workaround, consider restricting access to the forgetPassword function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-15398

Affected Products

Uasoft Badaso

References · 11

• 🔥 https://vuldb.com/?submit.720129 · Exploit
• 🔥 https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq · Exploit
• 🔥 https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq#-span--strong-step-1--trigger-password-reset-for-victim--strong---span- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15398 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15398 · Vendor Advisory
• https://vuldb.com/?ctiid.339207 · Note
• https://twitter.com/CVEnew/status/2006495354372423776 · Twitter Post
• https://t.me/CVEtracker/41129 · Telegram Post
• https://t.me/cveNotify/147556 · Telegram Post
• https://vuldb.com/?id.339207 · Note
• https://twitter.com/VulmonFeeds/status/2006548147099635817 · Twitter Post