CVE-2025-22973
Published: 20 February 2025
Description
An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application/common. php' file that directly retrieves the URL request response content.
Security Summary
CVE-2025-22973 is an information disclosure vulnerability in QiboSoft QiboCMS version X1.0. The flaw occurs in the http_curl() function within the '/application/common.php' file, which directly retrieves and exposes the response content of URL requests. This issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with no impairment to integrity or availability.
A remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no authentication privileges or user interaction. Exploitation involves triggering the http_curl() function to elicit responses that disclose sensitive information, such as internal application data or external service responses unintended for public exposure.
Mitigation guidance and additional details are available in the advisory referenced at https://github.com/202110420106/CVE/blob/master/CVE-2025-22973.md, published on 2025-02-20.
Details
- CWE(s)