PT-2025-5884 · Mindskip · Mindskip Xzs-Mysql 学之思开源考试系统

Vastzero · Published 2025-02-06 · Updated 2025-10-10 · CVE-2025-1083

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0

Description A problematic issue was found in the CORS Handler component, leading to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, but the complexity is rather high and the exploitation appears to be difficult. The issue has been publicly disclosed and the vendor was contacted but did not respond.

Recommendations For Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0, consider restricting access to the CORS Handler component to minimize the risk of exploitation until a fix is available. As a temporary workaround, review and limit the cross-domain policy to trusted domains only.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-942

Related Identifiers

CVE-2025-1083

Affected Products

Mindskip Xzs-Mysql 学之思开源考试系统

References · 10

• 🔥 https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1083 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1083 · Vendor Advisory
• https://twitter.com/CVEnew/status/1887641243427185016 · Twitter Post
• https://vuldb.com/?submit.489634 · Note
• https://t.me/cveNotify/138268 · Telegram Post
• https://t.me/cvedetector/17455 · Telegram Post
• https://vuldb.com/?ctiid.294859 · Note
• https://vuldb.com/?id.294859 · Note
• https://t.me/cvenotify/110310 · Telegram Post