PT-2025-6783 · Unknown · Bestinformed Web

David Miller + 1 · Published 2025-02-18 · Updated 2025-02-18 · CVE-2025-0422

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions BestInformed Web (affected versions not specified)

Description The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code execution. This can be achieved by creating ScriptVars with the type script and previewing them, for example, by creating a new information entry. By default, admin users have the necessary permissions, but with the granular permission system, these permissions can be assigned to other users as well. If an account with the correct permissions is compromised, an attacker can execute commands on the server running the BestInformed Web application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-0422

Affected Products

Bestinformed Web

References · 7

• https://cordaware.com/changelog/en/version-6_4_0_4-release-13_02_2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0422 · Security Note
• https://twitter.com/CveFindCom/status/1891760579284521282 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1891834190607323302 · Twitter Post
• https://twitter.com/CVEnew/status/1891764153494224965 · Twitter Post
• https://t.me/latest_high_impact_cve/1843 · Telegram Post
• https://t.me/cvedetector/18299 · Telegram Post