CVE-2025-66028

描述

### Summary During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface. However, despite accessing the admin panel, the user does not have sufficient permissions to view or interact with actual data. ### PoC Intercept the login response and change "isMasterAdmin": false → "isMasterAdmin": true <img width="1405" height="567" alt="image" src="https://github.com/user-attachments/assets/7036398b-bb41-46c1-b66a-e49ec2bc3abb" /> <img width="1533" height="476" alt="2" src="https://github.com/user-attachments/assets/4efcaef5-a939-4729-be43-3af62a7d02f8" /> ### Impact The admin dashboard is viewable.

如何修補 CVE-2025-66028

要修補 CVE-2025-66028,請將受影響套件升級到下列已修補版本。

• —升級至 8.0.5567 或更新版本

CVE-2025-66028 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 8.0.5567

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-66028
• PATCHgithub.com/OneUptime/oneuptime
• WEBgithub.com/OneUptime/oneuptime/commit/3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370
• WEBgithub.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8