The vulnerabilities, tracked as CVE-2025-47227 and CVE-2025-47228, affect version 1.0.003-build-2 of the Production Environment module included in ScriptCase version 9.12.006 (23), with previous versions likely vulnerable as well. The exploit involves three steps: first, a GET request to login.php sets the session variable to true; second, a request to secureimage.php obtains a CAPTCHA challenge; finally, a POST request with the action nm_action=change_pass successfully resets the administrator password. Two critical vulnerabilities in ScriptCase’s Production Environment module can be chained together to achieve pre-authenticated remote command execution on affected servers. Two severe CVE-tracked flaws in ScriptCase Production Environment module allow complete server takeover. The researchers developed an automated exploitation script that chains both vulnerabilities, includes CAPTCHA solving capabilities using OCR techniques, and can detect ScriptCase deployment paths automatically. The vulnerability exploits a timing issue where the session variable nm_session.prod_v8.login.is_page is set after the initial AJAX request processing. The nmPageAdminSysAllConectionsCreateWizard.class.php file contains a shell injection vulnerability in the GetListDatabaseNameMySql() function, where user input is directly concatenated into SSH commands without proper sanitization. Password reset bypass and shell injection result in full system access in three easy steps. The discovered vulnerabilities by the SYNACTIV team allow attackers to compromise servers without any authentication requirements at all. This completely bypasses authentication and grants administrative access to the Production Environment console. The vulnerability allows execution of arbitrary system commands with web server privileges, typically www-data. ScriptCase has not released official patches for either CVE-2025-47227 (authentication bypass) or CVE-2025-47228 (shell injection) as of the public disclosure date.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 07 Jul 2025 08:55:15 +0000