CVE-2025-1144 — AI Deep Analysis Summary

🚨 **Essence**: A critical flaw in the **Quanxun School Affairs System**. 📉 **Consequences**: Attackers can access specific pages to steal **database info** and **plain-text admin credentials**.…

🛡️ **Root Cause**: **CWE-497** - Exposure of Sensitive System Information to an Unauthorized Actor. 🐛 The system fails to protect sensitive data (DB & Admin creds) from unauthorized viewing.

🏫 **Affected**: **Quanxun School Affairs System** by **Quanxun**. 📦 Specific versions are not listed in the data, but any instance running this software is at risk. 🌐 Target: Educational institutions using this vendor.

🕵️ **Attacker Actions**: 1. View specific pages. 2. Extract **Database Information**. 3. Steal **Plain-text Admin Credentials**. 🔓 This grants full administrative control and data privacy violation.

🔓 **Exploitation Threshold**: **LOW**. 🚫 **Auth**: None required (PR:N). 🖱️ **UI**: None required. 🌐 **Network**: Remote (AV:N). 📉 **Complexity**: Low (AC:L). Easy to exploit!

📜 **Public Exploit**: **No PoC** listed in the data. 📢 However, **Third-party advisories** exist (TW-CERT). ⚠️ High risk of wild exploitation due to low barrier to entry.

🔍 **Self-Check**: Scan for **Quanxun School Affairs System** endpoints. 🕵️ Look for pages exposing **DB details** or **admin login forms** with visible credentials. 📡 Use vulnerability scanners targeting CWE-497.

🛠️ **Official Fix**: **Unknown**. 📅 Published: **2025-02-11**. 📝 No patch info provided in the data. Contact **Quanxun** vendor directly for updates. 📞

🚧 **Workaround**: 1. Restrict access to specific pages via **WAF** or **Firewall**. 2. Monitor logs for unauthorized DB/cred access. 3. Isolate the system from the public internet if possible. 🛑

🔥 **Urgency**: **CRITICAL**. 📈 **CVSS**: 9.8 (High). 🚨 Remote, unauthenticated, high impact. 🏃‍♂️ **Action**: Immediate mitigation required. Prioritize patching or network isolation. ⏳