CVE-2025-2043: LinZhaoguan pb-cms Add New Topic admin#themes deserialization
Description
A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Eine kritische Schwachstelle wurde in LinZhaoguan pb-cms 1.0.0 gefunden. Dies betrifft einen unbekannten Teil der Datei /admin#themes der Komponente Add New Topic Handler. Mittels dem Manipulieren des Arguments Topic Key mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
Classification
CVE ID: CVE-2025-2043
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.1
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products
Vendor: LinZhaoguan
Product: pb-cms
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 13.18% (scored less or equal to compared to others)
EPSS Date: 2025-04-04 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: poc
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-2043https://vuldb.com/?id.298787
https://vuldb.com/?ctiid.298787
https://vuldb.com/?submit.513243
https://github.com/Jingyi-u/Pb-cms2/blob/main/README.md