Badaso
CVE-2025-15398
LOW
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable reset endpoint and no auth required, but AC:H for token-prediction difficulty; impact limited to C:L account-level confidentiality with no integrity or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the forgetPassword function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Technical ContextAI
Badaso is a PHP-based CMS and administration panel built on the Laravel framework (vendor: Uatech, CPE: cpe:2.3:a:uatech:badaso:*:*:*:*:*:*:*:*). The vulnerable component is the forgetPassword method in src/Controllers/BadasoAuthController.php, which implements the password recovery token lifecycle. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) identifies the root cause class: the implementation fails to adequately protect the password reset token - through weak generation entropy, insufficient expiry, lack of binding to requester identity, or insecure transmission - allowing an attacker who can observe or predict the token to hijack the reset flow. This is a server-side logic flaw in a PHP controller, not a client-side vulnerability.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure and no fixed version is documented in any reference. Operators should consider disabling the password recovery feature entirely if it is not critical to operations - this eliminates the attack surface at the cost of requiring manual administrator-assisted resets. If password recovery must remain enabled, restrict the /forgot-password endpoint to known IP ranges or authenticated sessions where feasible, reducing exposure to opportunistic remote attackers. Implementing a Web Application Firewall rule to rate-limit or block repeated password reset requests for the same account can impede token-prediction attempts. Upgrading beyond 2.9.7 should be considered when a patched release becomes available; monitor https://vuldb.com/?id.339207 and the Badaso GitHub repository for any upstream fix activity.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today