CVE-2025-47227

Published Jul 5, 2025

Last updated 2 months ago

Netmake ScriptCase

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-47227 is an authentication bypass vulnerability found in the Production Environment extension of Netmake ScriptCase, affecting versions through 9.12.006 (23). This flaw specifically resides within the administrator password reset mechanism, which is improperly implemented. An unauthenticated attacker can exploit this vulnerability by sending a sequence of GET and POST requests to `login.php`. This manipulation allows the attacker to reset the administrator's password without prior authentication, leading to an administrator account takeover. This vulnerability can be chained with CVE-2025-47228 to achieve pre-authenticated remote command execution.

Description: In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
Source: cve@mitre.org
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-684

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

References