CVE-2025-25968 PoC — DDSN Interactive cm3 Acora CMS 安全漏洞

Source

https://github.com/padayali-JD/CVE-2025-25968

Associated Vulnerability

Title:DDSN Interactive cm3 Acora CMS 安全漏洞 (CVE-2025-25968)
Description:DDSN Interactive cm3 Acora CMS是DDSN Interactive公司的一个企业网络和移动 CMS。 DDSN Interactive cm3 Acora CMS 10.1.1版本存在安全漏洞，该漏洞源于存在不正确的权限改造漏洞，会导致帐户接管和潜在的权限提升。

Readme

# CVE-2025-25968: Improper Access Control vulnerability in DDSN Interactive cm3 Acora CMS version 10.1.1
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.

Affected version: Acora CMS v10.1.1 and possibly other versions

Discovered by Joby Y Daniel from Crowe India.

File Snapshot


 [4.0K]  /data/pocs/54aec66d5b5339d6313a3ca177267827f3cbc18f
└── [ 633]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!