Cyber Posture

CVE-2025-25206

High

Published: 14 February 2025

Published
14 February 2025
Modified
18 August 2025
KEV Added
—
Patch
—
CVSS Score 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0032 55.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Security Summary

CVE-2025-25206 is an input validation vulnerability (CWE-89) affecting eLabFTW, an open source electronic lab notebook used in research labs. In versions prior to 5.1.15, the flaw allows authenticated users to access sensitive information stored in the database, such as login tokens and other confidential content, due to improper handling of inputs.

An authenticated user with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Successful exploitation enables reading of sensitive data, potentially leading to privilege escalation, particularly when cookies are enabled, which is the default configuration.

The eLabFTW release notes and GitHub security advisory recommend upgrading to version 5.1.15, which addresses the issue through corrected input validation. No workarounds are available. Relevant resources include the release page at https://github.com/elabftw/elabftw/releases/tag/5.1.15 and the advisory at https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg.

Details

CWE(s)
CWE-89

Affected Products

elabftw
elabftw
≤ 5.1.15

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

SQL injection in web app allows authenticated low-priv users to read DB data including login tokens, enabling exploitation of public-facing app (T1190), privilege escalation (T1068), and access to unsecured credentials (T1552).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References