Cross-Site Request Forgery Protection Bypass in vtenext by Vte Solutions
CVE-2025-71454
6.9MEDIUM
Key Information:
Badges
👾 Exploit Exists
What is CVE-2025-71454?
The vtenext application prior to version 25.02.2 includes a vulnerability that allows an attacker to bypass cross-site request forgery (CSRF) protections. This occurs due to the csrf_check() function's insufficient validation of the __csrf_token for non-POST requests. By crafting a malicious link, an attacker can trick a logged-in user into executing state-altering GET requests. These requests are processed by the application as if initiated by the legitimate user, leading to unauthorized actions and potential data compromise.
Affected Version(s)
vtenext 0 < 25.02.2
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Mattia "0xbro" Brollo