CVE-2025-52289 PoC — MagnusBilling 安全漏洞

Source

https://github.com/Madhav-Bhardwaj/CVE-2025-52289

Associated Vulnerability

Title:MagnusBilling 安全漏洞 (CVE-2025-52289)
Description:A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval.

Readme

# CVE-2025-52289: Broken Access Control in MagnusBilling < v7.8.5.3

## Description

A **Broken Access Control** vulnerability exists in **MagnusBilling** versions prior to `v7.8.5.3`. Newly registered users can escalate their account status from `pending` to `active` without administrator approval by modifying a request parameter. This allows unauthorized access to system features intended only for verified users.

## Impact

- **Severity:** High  
- **Vulnerability Type:** Privilege Escalation / Broken Access Control  
- **CVE ID:** CVE-2025-52289

## Patch

The issue was fixed in version `v7.8.5.3`.

- 🔗 [Vendor Patch Commit](https://github.com/magnussolution/magnusbilling7/commit/f886330e9e9216a3830775610a4a83f970c08e8d)

## Credits

Discovered by **Madhav Bhardwaj**

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →