CVE-2025-45612

An attacker sends a specially crafted GET request to the /index path, which allows bypassing the application's access control mechanisms. Improper implementation of authentication logic causes the server to not verify the identity of the requester and grants access to protected resources. The attack requires no authentication, user interaction, or special network conditions.

An attacker gains unauthorized access to the application, which may lead to disclosure, modification or destruction of data, as well as the takeover of full control over resources protected by the authentication mechanism.

Apply patches available from the vendor according to the references. It is also recommended to implement an additional layer of access control (e.g., WAF application firewall) and monitor suspicious GET requests directed to the /index path until the fix is applied.

Exrick Xmall version 1.1