Authorization Flaw in Xujeff Tianti 天梯 Web Application
CVE-2025-8807
Key Information:
Badges
What is CVE-2025-8807?
A significant vulnerability has been identified in the Xujeff Tianti 天梯 web application, specifically affecting the save functionality within user administration. This flaw allows for unauthorized actions due to a lack of proper authorization checks in the 'ajax/save' endpoint. Attackers can exploit this weakness remotely, potentially leading to unauthorized access and manipulation of sensitive data. Despite early notifications to the vendor regarding this vulnerability, there has been no response, indicating a pressing need for affected users to assess their security measures and implement additional safeguards.
Affected Version(s)
tianti 天梯 2.0
tianti 天梯 2.1
tianti 天梯 2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.