Unauthenticated File Read Vulnerability in EzGED3 by Ballpoint Technologies
CVE-2025-51539
What is CVE-2025-51539?
EzGED3 version 3.5.0 is susceptible to an unauthenticated arbitrary file read vulnerability caused by improper access control and inadequate input validation in a specific PHP script. This vulnerability allows a remote attacker to manipulate path parameters, enabling unauthorized access to sensitive files within the filesystem. Without sufficient authentication checks or secure path management, the affected script is vulnerable to directory traversal attacks. Such attacks can lead to unauthorized access to critical files, including configuration settings, database information, and sensitive source code. In scenarios where phpMyAdmin is accessible, the compromised credentials can facilitate direct administrative access. Even in environments lacking these tools, attackers can exploit this vulnerability to extract entire databases by targeting raw MySQL data files. The flaw is addressed in version 3.5.72.27183.