CVE-2025-2589
Published: 21 March 2025
Summary
CVE-2025-2589 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Code-Projects Human Resource Management. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2589 is an improper authorization vulnerability affecting code-projects Human Resource Management System version 1.0.1. The flaw exists in the Index function within the file \handler\Account.go, where manipulation of the user_cookie argument enables unauthorized access. Classified as critical, it is associated with CWEs-266 (Incorrect Privilege Assignment), CWE-285 (Improper Authorization), and CWE-862 (Missing Authorization), with a CVSS 3.1 base score of 5.5.
Exploitation requires low privileges (PR:L) and access from an adjacent network (AV:A), with low attack complexity (AC:L) and no user interaction (UI:N). An attacker can achieve limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) in an unchanged scope (S:U), potentially bypassing authorization controls through the manipulated parameter.
The exploit has been publicly disclosed and may be used, as noted in the vulnerability description. Mitigation details, patches, or further advisories are referenced at https://code-projects.org/, https://github.com/38279/1/issues/1, https://vuldb.com/?ctiid.300569, https://vuldb.com/?id.300569, and https://vuldb.com/?submit.517343; security practitioners should consult these for updates. The vulnerability was published on 2025-03-21T13:15:34.830.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7253
Vulnerability details
A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to improper authorization. The exploit has been disclosed…
more
to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization via user_cookie manipulation in the Account handler allows a low-privileged attacker on an adjacent network to bypass controls and gain unauthorized access, directly enabling exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to resources, directly preventing unauthorized access resulting from manipulated user_cookie in the Index function.
SI-10 validates information inputs such as the user_cookie argument, blocking manipulation that leads to improper authorization.
AC-6 applies least privilege to restrict access beyond low-privilege users, mitigating impacts of incorrect privilege assignment via cookie manipulation.