CVE-2025-0206
Published: 04 January 2025
Summary
CVE-2025-0206 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Code-Projects Online Shoe Store. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-0206 is a vulnerability classified as critical in code-projects Online Shoe Store 1.0, affecting an unknown functionality within the /admin/index.php file. It stems from improper access controls, mapped to CWE-266 and CWE-284, and was published on 2025-01-04T12:15:24.830 with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can manipulate the affected functionality to bypass access controls, resulting in low-impact unauthorized disclosure of confidential information, with no impact on integrity or availability.
Advisories on VulDB (ctiid.290143, id.290143, submit.474033) document the issue, and a proof-of-concept exploit is publicly available via a GitHub Gist at https://gist.github.com/th4s1s/955b71b20235dddf30689d4b85b4d271. The project source is hosted at https://code-projects.org/. No patches or specific mitigations are detailed in the available references.
The exploit has been disclosed to the public and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1544
Vulnerability details
A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit…
more
has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated access control bypass in a public-facing web application (/admin/index.php) enabling information disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to /admin/index.php, preventing unauthorized remote exploitation due to improper access controls.
Explicitly identifies and authorizes only permitted actions without identification or authentication, blocking unauthenticated access to sensitive admin functionality.
Enforces least privilege to restrict the scope of unauthorized access even if initial controls are bypassed, limiting confidential information disclosure.