CVE-2025-1083

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1083
A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md Exploit Mitigation Third Party Advisory
https://vuldb.com/?ctiid.294859 Permissions Required VDB Entry
https://vuldb.com/?id.294859 Third Party Advisory VDB Entry
https://vuldb.com/?submit.489634 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:mindskip:xzs-mysql:3.9.0:*:*:*:*:*:*:*
History

10 Oct 2025, 20:58

Type Values Removed Values Added
CPE cpe:2.3:a:mindskip:xzs-mysql:3.9.0:*:*:*:*:*:*:*
First Time Mindskip
Mindskip xzs-mysql
References () https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md - () https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md - Exploit, Mitigation, Third Party Advisory
References () https://vuldb.com/?ctiid.294859 - () https://vuldb.com/?ctiid.294859 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.294859 - () https://vuldb.com/?id.294859 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.489634 - () https://vuldb.com/?submit.489634 - Third Party Advisory, VDB Entry
Summary
  • (es) Se encontró una vulnerabilidad clasificada como problemática en Mindskip xzs-mysql ????????? 3.9.0. Esta vulnerabilidad afecta una funcionalidad desconocida del componente CORS Handler. La manipulación conduce a una política permisiva entre dominios con dominios no confiables. El ataque se puede lanzar de forma remota. La complejidad de un ataque es bastante alta. La explotación parece ser difícil. La explotación se ha divulgado al público y puede usarse. Se contactó al proveedor con anticipación sobre esta divulgación, pero no respondió de ninguna manera.

06 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-06 23:15

Updated : 2025-10-10 20:58

NVD link : CVE-2025-1083

Mitre link : CVE-2025-1083

CVE.ORG link : CVE-2025-1083

JSON object : View

Products Affected

mindskip

  • xzs-mysql
CWE
CWE-346

Origin Validation Error

CWE-942

Permissive Cross-domain Policy with Untrusted Domains